This vulnerability (CVE-2026-0291) is classified as CWE-59 (Improper Link Resolution Before File Access). It affects the Prisma Access Agent specifically on Linux platforms. The flaw allows a local user with low privileges to exploit symbolic link handling to delete system files within a limited scope, which can lead to disabling the Prisma Access Agent. The vulnerability does not affect other operating system versions of the agent. The CVSS 4.0 base score is 1.1, indicating low severity. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

A local low privileged user on a Linux system running the Prisma Access Agent can delete certain system files, which may disable the agent. The impact is limited in scope and does not allow remote exploitation or privilege escalation beyond the local user context. The vulnerability does not affect other operating systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to systems running the Prisma Access Agent on Linux to trusted users only. Monitor for updates from Palo Alto Networks regarding patches or workarounds.