CVE-2026-0232

CVE-2026-0232 is a protection mechanism bypass vulnerability affecting the Palo Alto Networks Cortex XDR agent on Windows systems. The flaw allows a local Windows administrator to disable the agent, potentially allowing malware to operate without detection. This vulnerability specifically impacts endpoint detection and response capabilities on Windows platforms. The attack requires local administrator-level privileges, indicating moderate attack complexity and limiting the threat to trusted users or compromised administrative accounts. The potential impact is significant, as successful exploitation would eliminate security monitoring and detection mechanisms on affected endpoints, enabling undetected malicious activity. The vulnerability currently shows no evidence of active exploitation in the wild. It does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on security hotlists. The EPSS score of 0.00017 indicates minimal real-world exploitation activity, and community attention remains limited at this time.