The vulnerability is an information disclosure flaw (CWE-200) that allows a local user to read sensitive configuration data and credentials, exposing authentication secrets and configuration settings without providing remote code execution or privilege escalation beyond the local user context.

Affected products are Palo Alto Networks Prisma Access Agent for Windows and macOS versions 24.0 through 26.2. All other platform builds—Linux, Chrome OS, Android, iOS—are not affected.

The CVSS score of 4.3 indicates a low‑moderate severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attack would require local user presence; if an attacker gains local access, they could read protected files and extract credentials.