{"id":"CVE-2026-0232","title":"A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.","summary":"A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-15"],"vendor":"paloaltonetworks","product":"cortex_xdr_agent","affected":["cortex_xdr_agent >= 8.7.0, < 8.7.101","cortex_xdr_agent = 7.9","cortex_xdr_agent = 8.3","cortex_xdr_agent = 8.9.0","cortex_xdr_agent = 9.0.0"],"patched":["cortex_xdr_agent 8.7.101"],"published":"2026-04-13","updated":"2026-07-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0232","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0232","label":"psirt@paloaltonetworks.com"}],"tags":["nvd"],"epss":0.00146,"epssPercentile":0.04199,"ingestedAt":"2026-07-07T18:42:24.214Z","slug":"CVE-2026-0232","body":"## Overview\n\nA problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.\n\n## Affected\n\n- `cortex_xdr_agent >= 8.7.0, < 8.7.101`\n- `cortex_xdr_agent = 7.9`\n- `cortex_xdr_agent = 8.3`\n- `cortex_xdr_agent = 8.9.0`\n- `cortex_xdr_agent = 9.0.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `cortex_xdr_agent 8.7.101`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}