Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows

A local administrator on a Windows machine running Prisma Access Agent could bypass network security inspection, allowing them to inject malicious traffic or intercept sensitive data that should be protected by the agent.

Transportation sector organizations using Palo Alto Networks Prisma Access Agent on Windows endpoints are affected. This includes remote workers, mobile workforce, and branch offices that rely on the agent for secure network access. Linux, macOS, iOS, Android, and Chrome OS endpoints are not vulnerable.

An attacker with local administrator access to a Windows machine can exploit a flaw in the Prisma Access Agent network driver to bypass its security inspection mechanisms. Once bypassed, the attacker can inject, modify, or intercept network traffic that the agent should be protecting, potentially exfiltrating data or launching attacks on internal networks.