Cortex XDR Agent: Local Administrator can disable the agent on macOS
Monitor6.7CVE-2026-0230Mar 11, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary
A local administrator on a macOS system can disable the Cortex XDR Agent protection mechanism. This could allow malware to run on the system without detection by the agent's monitoring and response capabilities.
What this means
What could happen
A local administrator on a macOS system running Cortex XDR Agent can disable the agent, allowing malware to run on that system without detection by your security monitoring tools.
Who's at risk
This affects organizations running Cortex XDR Agent on macOS endpoints, particularly those where local users have administrator privileges. IT and security teams should be concerned about endpoint detection gaps on macOS systems if the agent is disabled.
How it could be exploited
An attacker with local administrator access on a macOS endpoint can disable the Cortex XDR Agent protection mechanism, removing endpoint detection and response visibility. The attacker could then execute malware or perform lateral movement to your network without triggering alarms.
Prerequisites
- Local administrator access on the macOS system
- Ability to interact with the Cortex XDR Agent protection mechanism on macOS
no patch availablerequires local administrator accesscould allow malware execution without detectionimpacts endpoint visibility
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (1)
ProductAffected VersionsFix Status
Cortex XDR AgentNone on macOSNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/1HARDENINGEnable Cortex XDR Agent tamper protection and alerting if available in your environment configuration
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HARDENINGMonitor for disabling or uninstallation of Cortex XDR Agent on macOS systems using endpoint management tools
HARDENINGReview and restrict local administrator accounts on critical macOS systems
Mitigations - no patch available
0/1Cortex XDR Agent has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement local admin controls to restrict which users can have administrator privileges on macOS endpoints
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/4900e97a-64a8-4ae7-a8fe-8c9713e18980Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.