CVE-2026-0230 - Vulnerability Details - OpenCVE

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.

Attack Vector Local

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Palo Alto Networks	Cortex Xdr Agent

No data.

No data.

No data.

References

Link	Providers
https://security.paloaltonetworks.com/CVE-2026-0230

History

Wed, 11 Mar 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.
Title		Cortex XDR Agent: Local Administrator can disable the agent on macOS
First Time appeared		Palo Alto Networks Palo Alto Networks cortex Xdr Agent
Weaknesses		CWE-754
CPEs		cpe:2.3:a:palo_alto_networks:cortex_xdr_agent::::::macOS::* cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3-CE:::::macOS:: cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3.101-CE:::::macOS:: cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.7-CE:::::macOS::
Vendors & Products		Palo Alto Networks Palo Alto Networks cortex Xdr Agent
References		https://security.paloaltonetworks.com/CVE-2026-0230
Metrics		cvssV4_0 `{'score': 4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber'}`

MITRE

Status: PUBLISHED

Assigner: palo_alto

Published: 2026-03-11T18:02:13.814Z

Updated: 2026-03-11T20:19:05.966Z

Reserved: 2025-11-03T20:43:51.178Z

Link: CVE-2026-0230

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-03-11T18:16:21.170

Modified: 2026-03-11T18:16:21.170

Link: CVE-2026-0230

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0230", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-11-03T20:43:51.178Z", "datePublished": "2026-03-11T18:02:13.814Z", "dateUpdated": "2026-03-11T20:19:05.966Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2026-03-11T18:02:13.814Z"}, "title": "Cortex XDR Agent: Local Administrator can disable the agent on macOS", "datePublic": "2026-03-11T16:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-578", "descriptions": [{"lang": "en", "value": "CAPEC-578 Disable Security Software"}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Cortex XDR Agent", "platforms": ["macOS"], "versions": [{"status": "unaffected", "version": "9.1.0", "versionType": "custom"}, {"status": "unaffected", "version": "9.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "8.9.0", "versionType": "custom"}, {"status": "affected", "version": "8.7-CE", "lessThan": "8.7.101-CE", "changes": [{"at": "8.7.101-CE", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "8.3-CE", "lessThan": "8.3.102-CE", "changes": [{"at": "8.3.102-CE", "status": "unaffected"}], "versionType": "custom"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.7-CE:*:*:*:*:macOS:*:*", "cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3-CE:*:*:*:*:macOS:*:*", "cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:8.3.101-CE:*:*:*:*:macOS:*:*"]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:*:*:*:*:*:macOS:*:*", "versionEndExcluding": "8.7.101-ce", "versionStartIncluding": "8.7.101", "vulnerable": true}, {"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_agent:*:*:*:*:*:macOS:*:*", "versionEndExcluding": "8.3.102-ce", "versionStartIncluding": "8.3.102", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "value": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection."}]}], "references": [{"url": "https://security.paloaltonetworks.com/CVE-2026-0230", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/RE:M/U:Amber"}}], "configurations": [{"lang": "eng", "value": "No special configuration is required to be affected by this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "No special configuration is required to be affected by this issue."}]}], "solutions": [{"lang": "eng", "value": "This issue is fixed in Cortex XDR Agent 8.9.0, Cortex XDR Agent 8.7.101-CE, Cortex XDR Agent 8.3.102-CE, and all later Cortex XDR Agent versions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This issue is fixed in Cortex XDR Agent 8.9.0, Cortex XDR Agent 8.7.101-CE, Cortex XDR Agent 8.3.102-CE, and all later Cortex XDR Agent versions."}]}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}]}], "timeline": [{"time": "2026-03-11T16:00:00.000Z", "lang": "en", "value": "Initial publication."}], "credits": [{"lang": "en", "value": "Michael Roitzsch, Barkhausen Institut gGmbH Carsten Weinhold, Barkhausen Institut gGmbH", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "x_affectedList": ["Cortex XDR Agent 8.8.0", "Cortex XDR Agent 8.7-CE", "Cortex XDR Agent 8.3-CE", "Cortex XDR Agent 8.3.101-CE"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T20:18:26.611672Z", "id": "CVE-2026-0230", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T20:19:05.966Z"}}]}}