{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-0268",
        "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "state": "PUBLISHED",
        "assignerShortName": "palo_alto",
        "dateReserved": "2025-11-03T20:44:28.362Z",
        "datePublished": "2026-06-10T20:40:11.198Z",
        "dateUpdated": "2026-06-11T13:57:54.692Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
                "shortName": "palo_alto",
                "dateUpdated": "2026-06-10T20:40:11.198Z"
            },
            "title": "Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux",
            "datePublic": "2026-06-10T16:00:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-424",
                            "description": "CWE-424 Improper Protection of Alternate Path",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "impacts": [
                {
                    "capecId": "CAPEC-180",
                    "descriptions": [
                        {
                            "lang": "en",
                            "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "Palo Alto Networks",
                    "product": "Prisma Access Agent",
                    "platforms": [
                        "Linux"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThan": "26.2.1",
                            "changes": [
                                {
                                    "at": "26.2.1",
                                    "status": "unaffected"
                                }
                            ],
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                },
                {
                    "vendor": "Palo Alto Networks",
                    "product": "Prisma Access Agent",
                    "platforms": [
                        "Windows",
                        "macOS",
                        "iOS",
                        "Android",
                        "Chrome OS"
                    ],
                    "versions": [
                        {
                            "status": "unaffected",
                            "version": "All",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "cpeMatch": [
                                {
                                    "criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*",
                                    "versionEndExcluding": "26.2.1",
                                    "versionStartIncluding": "26.2.0",
                                    "vulnerable": true
                                }
                            ],
                            "negate": false,
                            "operator": "OR"
                        }
                    ],
                    "operator": "OR"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.\n\n\n\nThis does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<p><span>A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel.</span></p><p><span>This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.</span></p>"
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://security.paloaltonetworks.com/CVE-2026-0268",
                    "tags": [
                        "vendor-advisory"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "LOCAL",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "privilegesRequired": "LOW",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "LOW",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "UNREPORTED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NO",
                        "Recovery": "USER",
                        "valueDensity": "DIFFUSE",
                        "vulnerabilityResponseEffort": "MODERATE",
                        "providerUrgency": "AMBER",
                        "version": "4.0",
                        "baseSeverity": "MEDIUM",
                        "baseScore": 4.4,
                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"
                    }
                }
            ],
            "configurations": [
                {
                    "lang": "eng",
                    "value": "No special configuration is required.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "No special configuration is required."
                        }
                    ]
                }
            ],
            "workarounds": [
                {
                    "lang": "eng",
                    "value": "There are no known workarounds for this issue.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "There are no known workarounds for this issue."
                        }
                    ]
                }
            ],
            "solutions": [
                {
                    "lang": "eng",
                    "value": "VERSION                                MINOR VERSION         SUGGESTED SOLUTION\nPrisma Access Agent on Linux           25.7 through 26.2.0   Upgrade to 26.2.1 or later.\nPrisma Access Agent All on Windows                           No action needed.\nPrisma Access Agent All on macOS                             No action needed.\nPrisma Access Agent All on iOS                               No action needed.\nPrisma Access Agent All on Android                           No action needed.\nPrisma Access Agent All on Chrome OS                         No action needed.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n                                    <td>Prisma Access Agent   on Linux<br></td>\n                                    <td>25.7 through 26.2.0</td>\n                                    <td>Upgrade to 26.2.1 or later.</td>\n                                </tr><tr><td>Prisma Access Agent All on Windows<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on macOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on iOS<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Android<br></td><td></td><td>No action needed.</td></tr><tr><td>Prisma Access Agent All on Chrome OS<br></td><td></td><td>No action needed.</td></tr></tbody></table>"
                        }
                    ]
                }
            ],
            "exploits": [
                {
                    "lang": "en",
                    "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
                        }
                    ]
                }
            ],
            "timeline": [
                {
                    "time": "2026-06-10T16:00:00.000Z",
                    "lang": "en",
                    "value": "Initial publication."
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "our internal security research teams",
                    "type": "finder"
                }
            ],
            "source": {
                "discovery": "INTERNAL"
            },
            "x_generator": {
                "engine": "Vulnogram 0.1.0-dev"
            },
            "x_affectedList": [
                "Prisma Access Agent   26.2.0"
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-06-11T13:57:46.995690Z",
                                "id": "CVE-2026-0268",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-06-11T13:57:54.692Z"
                }
            }
        ]
    }
}