Prisma Access Agent: Improper Certificate Validation on iOS
An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic.
The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.
Description: CAPEC-94 Adversary in the Middle (AiTM)
Solutions
Version
Minor Version
Suggested Solution
Prisma Access Agent on iOS
25.0 through 26.2
Upgrade to 26.2.1 or later.
Prisma Access Agent on Linux
No action needed.Prisma Access Agent on Windows
No action needed.Prisma Access Agent on macOS
No action needed.Prisma Access Agent on Android
No action needed.Prisma Access Agent on ChromeOS
No action needed.
Configurations
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds exist for this issue.
Exploits
Palo Alto Networks is not aware of any malicious exploitation of this issue.