Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.
Version Minor Version Suggested Solution
Prisma Access Agent (Endpoint DLP) 25.0 through 26.2 Upgrade to 26.2.1 or later.
Configurations
Endpoint DLP must be enabled. Steps for determining this can be found in our technical documentation. (https://docs.paloaltonetworks.com/enterprise-dlp/administration/configure-enterprise-dlp/endpoint-dlp/troubleshoot-endpoint-dlp)Please refer to Step 1 and Step 6 in the provided link.
Workarounds
No known workarounds exist for this issue.
Exploits
Palo Alto Networks is not aware of any malicious exploitation of these issues.
Credits
other
Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue.