Medium 4.0Published Mar 11, 2026

CVE-2026-0230Cortex XDR Agent: Local Administrator can disable the agent on macOS

Updated under an hour ago (Oct 27, 2026, 3:30 PM ET)

Does this affect you?

It affects Palo Alto Networks Cortex XDR Agent. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Palo Alto Networks Cortex XDR Agent

Exploited in the last 30 days

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.

CVSS: 4.0 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber
Weakness (CWE): CWE-754
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: palo_alto
NVD analysis: Awaiting Analysis
Record last updated: Mar 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Palo Alto Networks Cortex XDR Agent palo_alto_networks:cortex_xdr_agent	9.1.0 not affected; 9.0.0 not affected; 8.9.0 not affected; from 8.7-CE before 8.7.101-CE; fixed at 8.7.101-CE; from 8.3-CE before 8.3.102-CE; fixed at 8.3.102-CE	CNA record

References

References

https://security.paloaltonetworks.com/CVE-2026-0230	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.