CVE-2026-0271: Palo Alto Networks Prisma Access Agent privilege escalation in Linux app

CVE-2026-0271 · Severity: info · CVSS 5.9 · Published 2026-06-10

A security vulnerability in the Palo Alto Networks Prisma Access Agent for Linux could allow a person with standard user access to gain full administrative control over the device. This agent is typically used to provide secure remote access to corporate resources. If exploited, an attacker who already has a foothold on a Linux machine could bypass security restrictions to access sensitive data or disrupt system operations.

Technologies: Palo Alto Networks Prisma Access Agent. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0271 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0271 being exploited in the wild.
How severe is CVE-2026-0271?
Informational severity, with a CVSS score of 5.9, published 10 June 2026.
Which products and versions are affected?
Palo Alto Networks Prisma Access Agent < 26.2.1 on Linux.
Is there a fix for CVE-2026-0271?
A patch was published on 2026-06-10: Fixed in version 26.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0271 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-0271?
Check whether you run Palo Alto Networks Prisma Access Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in the Palo Alto Networks Prisma Access Agent for Linux due to incorrect permission assignment for a critical resource (CWE-732). The flaw allows a local authenticated user with low privileges to execute arbitrary code with elevated (root) privileges. The vulnerability is specific to the Linux version of the agent and does not affect Windows, macOS, iOS, Android, or ChromeOS versions. Attackers require local shell access but no special configuration or user interaction to trigger the exploit. Palo Alto Networks has addressed this issue in Prisma Access Agent version 26.2.1 for Linux.

Affected products

  • Palo Alto Networks Prisma Access Agent < 26.2.1 on Linux

Timeline

  • 2026-06-10: disclosed: Initial publication of the advisory
  • 2026-06-10: patched: Fixed in version 26.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.