This vulnerability (CWE-862) in the Palo Alto Networks Prisma Access Agent involves missing authorization checks in the privilege management mechanism. It enables a locally authenticated user without administrative rights to escalate privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This escalation allows execution of arbitrary code and access to sensitive data restricted to privileged accounts. The issue is limited to desktop operating systems and does not impact mobile or Chrome OS versions of the agent. No patch or official remediation level has been published by the vendor as of now.

An attacker with local non-administrative access can escalate privileges to the highest system level, potentially leading to full system compromise. This includes executing arbitrary code with elevated privileges and accessing sensitive information normally restricted to administrators. The vulnerability affects macOS, Linux, and Windows versions of the Prisma Access Agent. The Prisma Access Agent on iOS, Android, and Chrome OS are not impacted. There are no known public exploits currently.

Patch status is not yet confirmed — check the Palo Alto Networks vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts. Do not assume the vulnerability is mitigated without vendor confirmation.