CVE-2026-0278 MEDIUM

CVE-2026-0278: Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows

Vendor Palo Alto Networks
Product Prisma Access Agent
Weakness CWE-693
Published July 9, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:C/RE:H/U:Amber

What the vulnerability does

01Description

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

Key dates

02Disclosure timeline

July 9, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2025-12094 OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing CVE-2024-11197 Lock User Account <= 1.0.5 - User Lock Bypass CVE-2023-0085 Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass CVE-2024-0682 Page Restrict <= 2.5.5 - Protection Mechanism Bypass CVE-2024-13794 Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure