OTPulse

Prisma Access Agent: Local Privilege Escalation by Authorized Users

Plan PatchCVSS 8.5CVE-2026-0271Jun 10, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary

A privilege escalation vulnerability in Palo Alto Networks Prisma Access Agent on Linux allows a local user with access to the device to execute code with elevated privileges (root/system level access). The vulnerability exists in versions before 26.2.1 on Linux. No equivalent vulnerability affects Windows, macOS, iOS, Android, or ChromeOS versions.

What this means
What could happen
An authorized user on a Linux workstation running Prisma Access Agent could escalate their privileges to run commands as root, potentially compromising the security of the entire endpoint and any systems it connects to, including your OT network if the workstation is used as an engineering or administrative access point.
Who's at risk
Organizations that deploy Palo Alto Networks Prisma Access Agent on Linux workstations used for remote management or access to OT systems, including engineering workstations, jump hosts, or administrator laptops connecting to the plant network. This does not affect Windows, Mac, mobile, or Chromebook endpoints.
How it could be exploited
An attacker with local user-level access to a Linux computer running the Prisma Access Agent (e.g., a disgruntled employee or contractor) can exploit the vulnerability to gain root-level code execution on that machine. Once elevated, the attacker could install malware, steal credentials, or pivot to connected OT systems.
Prerequisites
  • Local user account on a Linux system
  • Prisma Access Agent running on that Linux system
  • Prisma Access Agent version below 26.2.1
affects Linux systems onlyrequires local user accessno authentication bypasslow complexity exploitation
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (6)
1 with fix5 pending
ProductAffected VersionsFix Status
Prisma Access AgentBelow 26.2.1 on Linux26.2.1 on Linux+
Prisma Access AgentNone on macOSNo fix yet
Prisma Access AgentNone on WindowsNo fix yet
Prisma Access AgentNone on iOSNo fix yet
Prisma Access AgentNone on AndroidNo fix yet
Prisma Access AgentNone on Chrome OSNo fix yet
Remediation & Mitigation
0/3
Do now
0/1
Prisma Access Agent
HARDENINGRestrict local user access on Linux workstations running Prisma Access Agent to trusted personnel only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Prisma Access Agent
HOTFIXUpdate Prisma Access Agent to version 26.2.1 or later on all Linux systems
Long-term hardening
0/1
Prisma Access Agent
HARDENINGMonitor Linux system logs and privilege escalation attempts on machines running Prisma Access Agent
View full vendor advisory
API: /api/v1/advisories/8c8c368a-0fd5-4ed2-8996-313f66528724

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Prisma Access Agent: Local Privilege Escalation by Authorized Users | CVSS 8.5 - OTPulse