CVE-2026-0278: Prisma Access Agent DLP Bypass on Windows (CVSS 7.8)

Technical summary

CVE-2026-0278 involves multiple protection mechanism failures in the Prisma Access Agent DLP component on Windows, classified under CWE-693 (Protection Mechanism Failure). The vulnerability allows a local, authenticated user to bypass DLP policy enforcement controls without user interaction. The attack has high impact on confidentiality, integrity, and availability (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8). The macOS variant of Prisma Access Agent is explicitly unaffected.

Business impact

Organizations relying on Prisma Access Agent's DLP capabilities on Windows may experience data exfiltration if a user with local system access exploits this vulnerability. Sensitive data—financial records, intellectual property, personal information—could bypass intended protection controls. Compliance obligations (GDPR, HIPAA, CCPA) may be violated if DLP systems fail to contain data as designed. Affected organizations face potential data breach notification costs, regulatory fines, and reputational harm.

Affected systems

Vulnerable systems include Windows endpoints running Palo Alto Networks Prisma Access Agent. macOS deployments are not affected. The scope is limited to Windows; organizations with macOS-only or hybrid deployments (where Windows endpoints are unaffected) face lower risk. Determine which Windows devices are enrolled in Prisma Access Agent and what sensitivity of data flows through them to assess exposure.

Exploitability

Exploitation requires local user access with at least basic privileges—an insider, compromised account, or attacker with initial endpoint foothold. No network access, special configuration, or user interaction is required once local access is established. Attack complexity is low, making it straightforward for an attacker to execute once they have a foothold. This is a critical concern for environments with high user turnover, shared systems, or elevated insider threat risks.

Remediation

Apply a vendor security update for Palo Alto Networks Prisma Access Agent on all affected Windows systems. Verify patch availability and version applicability against the Palo Alto Networks advisory. Until patched, restrict local administrative privileges and monitor for suspicious data access patterns. Consider enforcing endpoint detection and response (EDR) tooling to detect anomalous DLP bypass attempts or data staging behavior.

Patch guidance

Check Palo Alto Networks' official security advisory for patched Prisma Access Agent versions. Apply patches to Windows endpoints through your standard deployment pipeline (endpoint management tools, group policy, or vendor patch mechanisms). Test patches in a pre-production environment before broad rollout, especially if Prisma Access Agent is critical to your data protection strategy. Prioritize Windows systems handling high-risk data. Verify after patching that DLP policies are functioning as expected.

Detection guidance

Monitor Windows event logs and Prisma Access Agent logs for unusual data access or file operations originating from privileged local users. Flag attempts to access, copy, or move sensitive files to non-protected locations or external media. Monitor for process execution patterns that suggest DLP policy circumvention (e.g., alternate data paths, API calls that bypass normal channels). EDR solutions should alert on suspicious local file operations or privilege escalation followed by data operations. Network monitoring may not detect local bypass attempts, so endpoint-level visibility is essential.

Why prioritize this

This vulnerability scores 7.8 (HIGH CVSS 3.1) due to high confidentiality, integrity, and availability impact combined with low attack complexity and local access requirements. While it requires local presence, the consequence—complete bypass of DLP controls—directly threatens the security controls organizations rely on to prevent data loss. Organizations using Prisma Access Agent for DLP on Windows should patch urgently. Priority should be higher for systems handling regulated or highly sensitive data.

Risk score, explained

CVSS 3.1 score of 7.8 reflects: (1) Attack Vector Local—requires local access, limiting blast radius but not irrelevant given insider and compromise scenarios; (2) Attack Complexity Low—no special conditions or tricks needed; (3) Privileges Required Low—standard user permissions suffice; (4) User Interaction None—no social engineering or user action needed; (5) Scope Unchanged—impact confined to the system; (6) Confidentiality, Integrity, Availability High—the DLP mechanism itself is compromised, allowing data exfiltration, modification, and potential system impact. The HIGH severity is warranted given DLP's role in data protection strategy.

Frequently asked questions