---
id: CVE-2026-0232
title: "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent.\_This issue may be leveraged by malware to perform malicious activity without detection."
summary: "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent.\_This issue may be leveraged by malware to perform malicious activity without detection."
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-15
vendor: paloaltonetworks
product: cortex_xdr_agent
affected:
  - 'cortex_xdr_agent >= 8.7.0, < 8.7.101'
  - cortex_xdr_agent = 7.9
  - cortex_xdr_agent = 8.3
  - cortex_xdr_agent = 8.9.0
  - cortex_xdr_agent = 9.0.0
patched:
  - cortex_xdr_agent 8.7.101
published: '2026-04-13'
updated: '2026-07-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0232'
references:
  - url: 'https://security.paloaltonetworks.com/CVE-2026-0232'
    label: psirt@paloaltonetworks.com
tags:
  - nvd
epss: 0.00146
epssPercentile: 0.04199
ingestedAt: '2026-07-07T18:42:24.214Z'
---

## Overview

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.

## Affected

- `cortex_xdr_agent >= 8.7.0, < 8.7.101`
- `cortex_xdr_agent = 7.9`
- `cortex_xdr_agent = 8.3`
- `cortex_xdr_agent = 8.9.0`
- `cortex_xdr_agent = 9.0.0`

## Remediation

Upgrade past the affected range:

- `cortex_xdr_agent 8.7.101`