CVE-2026-0275: Palo Alto Networks Prisma Browser macOS Privilege Escalation Vulnerability

Technical summary

CVE-2026-0275 is a privilege escalation vulnerability stemming from improper privilege management (CWE-269) in Prisma Browser for macOS. An attacker with local administrator credentials and filesystem access can bypass privilege controls to execute arbitrary actions with root privileges. The attack has no user interaction requirement and operates entirely at the local level, as indicated by the CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N). The vulnerability does not propagate remotely and is isolated to macOS deployments.

Business impact

Organizations running Prisma Browser on macOS should assess whether malicious or compromised administrator accounts pose an acceptable risk within their environment. The threat model is constrained—an attacker must already possess admin credentials—but once leveraged, full system compromise becomes possible. For security-conscious deployments, this may necessitate additional access controls, audit logging, or isolation of administrator accounts from untrusted networks. The medium CVSS score reflects the prerequisite of high-privilege access, limiting blast radius but not impact severity.

Affected systems

Only Palo Alto Networks Prisma Browser running on Apple macOS is affected. Linux, Windows, and browser implementations on other platforms are unaffected. Organizations should identify all macOS endpoints where Prisma Browser is deployed and prioritize those with multi-tenant or shared-admin usage patterns where credential compromise is more plausible.

Exploitability

Exploitation requires prior compromise or misuse of a local administrator account with filesystem access. The attack does not require social engineering or user interaction, meaning a malicious admin can act immediately without tricking users. However, the barrier to entry—needing admin credentials—keeps this from being opportunistically exploitable by remote attackers or unprivileged users. Organizations with strong password policies, multi-factor authentication on administrative accounts, and privileged access management controls will see significantly reduced risk.

Remediation

Palo Alto Networks will issue a security patch to address this issue. Monitor the Palo Alto Networks security advisories page for availability and version numbers. In the interim, reduce attack surface by restricting administrative access on macOS systems running Prisma Browser, implementing account monitoring for unusual privilege escalation attempts, and ensuring admin credentials are protected with strong authentication mechanisms. Consider disabling Prisma Browser on systems where it is not actively required.

Patch guidance

Check the Palo Alto Networks security bulletin for Prisma Browser on macOS for the patched version number and deployment instructions specific to your environment. Apply patches during a scheduled maintenance window, as the local nature of this vulnerability means you have time for careful, tested deployment. Verify the patch version against the official advisory before rollout to ensure authenticity.

Detection guidance

Monitor for unusual root-level process execution originating from the Prisma Browser application or its child processes on macOS systems. Audit administrative account logins and privilege escalation attempts using native macOS logging (unified logs, audit logs). Network detection is not applicable. Endpoint detection and response (EDR) tools should be configured to alert on unexpected privilege elevation by processes associated with Prisma Browser or filesystem-based exploitation patterns.

Why prioritize this

Although the CVSS score is medium (6.7), prioritization should account for your organizational context. Environments with strong admin access controls, multi-factor authentication, and audit logging can safely defer patching to a standard cycle. High-risk environments—those with shared admin accounts, legacy credential management, or Prisma Browser deployed on security-critical endpoints—should prioritize this patch more urgently. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not been widely observed.

Risk score, explained

The CVSS 3.1 score of 6.7 (MEDIUM) reflects the combination of high impact (confidentiality, integrity, and availability all rated HIGH) offset by significant attack complexity requirements. The local attack vector (AV:L) and high privilege requirement (PR:H) prevent this from reaching CRITICAL or HIGH status. However, the complete impact spectrum—once the privilege escalation succeeds, an attacker can read, modify, or delete any system resource—justifies the medium rating and warrants timely patching in most environments.

Frequently asked questions