The vulnerabilities reside in the Endpoint DLP component of Palo Alto Networks Prisma Access Agent. A local attacker can exploit the improper authorization controls, bypassing required authentication and performing operations with elevated privileges. The weakness is identified as improper authorization (CWE‑306).

Affected software includes Prisma Access Agent Endpoint DLP versions 25.0 through 26.2 on both macOS and Windows platforms. Any endpoint running these versions is susceptible to the bypass.

The CVSS score of 5.9 indicates moderate severity. EPSS data is unavailable, suggesting no publicly known exploit activity; the vulnerability is not cataloged in CISA KEV. However, because the attack requires local presence, admins should consider the risk of privilege escalation. Upgrading to 26.2.1 or later installs the fix; without a fix the vulnerability could allow a local attacker to take over the endpoint.