AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Palo Alto NetworksCVE-2026-0306

Palo Alto Networks Prisma: local user could bypass configured DLP policy...

Palo Alto Networks

CVE-2026-0306 · Published Sep 10, 2026

Medium5.8
Fix: upgrade to 26.2 or later
Palo Alto Networks advisory

A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data.

This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.

Affected versions

PackageAffectedFixed in
Prisma Access Agent
Product
< 26.226.2
Details and references
CVSS 4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-693

More Palo Alto Networks advisories

All Palo Alto Networks
Low 2.4Sep 10Palo Alto Networks Checkov by Prisma Cloud: code executionCVE-2026-0303fixed in 3.2.532Medium 4.8Sep 10Palo Alto Networks Cortex XDR Broker VM: privilege escalationCVE-2026-0304fixed in 32.0.52Low 1.1Sep 10Palo Alto Networks Checkov by Prisma Cloud: command injectionCVE-2026-0302fixed in 3.2.502High 7.2Sep 10Palo Alto Networks Cloud NGFW: buffer overflowCVE-2026-0310fixed in 12.2.3 +4Medium 5.9Sep 10Palo Alto Networks GlobalProtect App: privilege escalationCVE-2026-0307fixed in 6.3.3-h15 +2Low 1.1Sep 10Palo Alto Networks PAN-OS: cross-site scriptingCVE-2026-0308fixed in 12.1.10 +2