CVE-2026-0268 - Vulnerability Details - OpenCVE

A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Palo Alto Networks	Prisma Access Agent

No data.

No data.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2026-0268

History

Thu, 11 Jun 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Jun 2026 21:00:00 +0000

Type	Values Removed	Values Added
Description		A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.
Title		Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux
First Time appeared		Palo Alto Networks Palo Alto Networks prisma Access Agent
Weaknesses		CWE-424
CPEs		cpe:2.3:a:palo_alto_networks:prisma_access_agent::::::Linux::*
Vendors & Products		Palo Alto Networks Palo Alto Networks prisma Access Agent
References		https://security.paloaltonetworks.com/CVE-2026-0268
Metrics		cvssV4_0 `{'score': 4.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2026-06-10T20:40:11.198Z

Updated: 2026-06-11T13:57:54.692Z

Reserved: 2025-11-03T20:44:28.362Z

Link: CVE-2026-0268

Vulnrichment

Updated: 2026-06-11T13:57:49.879Z

NVD

Status : Awaiting Analysis

Published: 2026-06-10T22:16:53.413

Modified: 2026-06-11T15:21:30.653

Link: CVE-2026-0268

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0268", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:28.362Z", "datePublished": "2026-06-10T20:40:11.198Z", "dateUpdated": "2026-06-11T13:57:54.692Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T20:40:11.198Z"}, "title": "Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux", "datePublic": "2026-06-10T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-424", "description": "CWE-424 Improper Protection of Alternate Path", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "26.2.1", "changes": [{"at": "26.2.1", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Windows", "macOS", "iOS", "Android", "Chrome OS"], "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*", "versionEndExcluding": "26.2.1", "versionStartIncluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.\n\n\n\nThis does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.</span></p><p><span>This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.</span></p>"}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0268", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required."}]}], "workarounds": [{"lang": "eng", "value": "There are no known workarounds for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "There are no known workarounds for this issue."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Linux 25.7 through 26.2.0 Upgrade to 26.2.1 or later.\nPrisma Access Agent All on Windows No action needed.\nPrisma Access Agent All on macOS No action needed.\nPrisma Access Agent All on iOS No action needed.\nPrisma Access Agent All on Android No action needed.\nPrisma Access Agent All on Chrome OS No action needed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Linux<br></td>\n <td>25.7 through 26.2.0</td>\n <td>Upgrade to 26.2.1 or later.</td>\n </tr><tr><td>Prisma Access Agent All on Windows<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-06-10T16:00:00.000Z", "lang": "en", "value": "Initial publication."}], "credits": [{"lang": "en", "value": "our internal security research teams", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_affectedList": ["Prisma Access Agent 26.2.0"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T13:57:46.995690Z", "id": "CVE-2026-0268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:57:54.692Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0268", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:44:28.362Z", "datePublished": "2026-06-10T20:40:11.198Z", "dateUpdated": "2026-06-11T13:57:54.692Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-06-10T20:40:11.198Z"}, "title": "Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux", "datePublic": "2026-06-10T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-424", "description": "CWE-424 Improper Protection of Alternate Path", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "26.2.1", "changes": [{"at": "26.2.1", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "platforms": ["Windows", "macOS", "iOS", "Android", "Chrome OS"], "versions": [{"status": "unaffected", "version": "All", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*", "versionEndExcluding": "26.2.1", "versionStartIncluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.\n\n\n\nThis does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><span>A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.</span></p><p><span>This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.</span></p>"}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0268", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required."}]}], "workarounds": [{"lang": "eng", "value": "There are no known workarounds for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "There are no known workarounds for this issue."}]}], "solutions": [{"lang": "eng", "value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Linux 25.7 through 26.2.0 Upgrade to 26.2.1 or later.\nPrisma Access Agent All on Windows No action needed.\nPrisma Access Agent All on macOS No action needed.\nPrisma Access Agent All on iOS No action needed.\nPrisma Access Agent All on Android No action needed.\nPrisma Access Agent All on Chrome OS No action needed.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Prisma Access Agent on Linux<br></td>\n <td>25.7 through 26.2.0</td>\n <td>Upgrade to 26.2.1 or later.</td>\n </tr><tr><td>Prisma Access Agent All on Windows<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>"}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-06-10T16:00:00.000Z", "lang": "en", "value": "Initial publication."}], "credits": [{"lang": "en", "value": "our internal security research teams", "type": "finder"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_affectedList": ["Prisma Access Agent 26.2.0"]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T13:57:46.995690Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:57:49.879Z"}}]}}