CVE-2022-0026

Published: May 11, 2022Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.

Affected (20)

Products: Paloaltonetworks: Cortex Xdr Agent

Paloaltonetworks

1 product

Cortex Xdr Agent

Configuration A

20 vulnerable · 19 platform

Vulnerable Software	Affected Versions
Paloaltonetworks Cortex Xdr Agent	Version 6.1.4 hotfix
Paloaltonetworks Cortex Xdr Agent	Version 6.1.5
Paloaltonetworks Cortex Xdr Agent	Version 6.1.5 hotfix
Paloaltonetworks Cortex Xdr Agent	Version 6.1.6
Paloaltonetworks Cortex Xdr Agent	Version 6.1.7
Paloaltonetworks Cortex Xdr Agent	Version 6.1.8
Paloaltonetworks Cortex Xdr Agent	Version 6.1.9
Paloaltonetworks Cortex Xdr Agent	Version 6.1
Paloaltonetworks Cortex Xdr Agent	Version 7.4.1
Paloaltonetworks Cortex Xdr Agent	Version 7.4.2
Paloaltonetworks Cortex Xdr Agent	Version 7.4.3
Paloaltonetworks Cortex Xdr Agent	Version 7.4.4
Paloaltonetworks Cortex Xdr Agent	Version 7.5.1
Paloaltonetworks Cortex Xdr Agent	Version 7.5.2
Paloaltonetworks Cortex Xdr Agent	Version 7.5.3
Paloaltonetworks Cortex Xdr Agent	Version 7.5
Paloaltonetworks Cortex Xdr Agent	Version 7.6.1
Paloaltonetworks Cortex Xdr Agent	Version 7.6.2
Paloaltonetworks Cortex Xdr Agent	Version 7.7.1
Paloaltonetworks Cortex Xdr Agent	Version 7.7

Running on/with	Platform Versions
Paloaltonetworks Cortex Xdr Agent	Version 6.1.4 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1.5 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1.6 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1.7 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1.8 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1.9 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 6.1 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.4.1 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.4.2 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.4.3 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.4.4 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.5.1 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.5.2 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.5.3 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.6.1 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.6.2 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.7.1 content_update330
Paloaltonetworks Cortex Xdr Agent	Version 7.7 content_update330
Microsoft Windows	All versions

Related CWEs

CWE-282

Improper Ownership Management

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

References (2)

https://security.paloaltonetworks.com/CVE-2022-0026

Source: psirt@paloaltonetworks.com

Vendor Advisory

https://security.paloaltonetworks.com/CVE-2022-0026

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.