The vulnerability allows an attacker to present a certificate for any domain that is issued by a trusted Certificate Authority. By doing so, the attacker can intercept the VPN traffic of the Prisma Access Agent on affected platforms, potentially capturing sensitive device information. This forms a classic denial of secure communication scenario where confidentiality is compromised. The weakness aligns with CWE-295 and can lead to full traffic eavesdropping.

Palo Alto Networks Prisma Access Agent on Android and Chrome OS versions 25.0 through 26.2 are affected. The agent on macOS, Windows, Linux, and iOS is not impacted.

The CVSS score of 6.2 indicates medium severity. Although EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the potential for a network‑based man‑in‑the‑middle attack remains. The likely attack vector is a remote attacker who can position themselves between the device and the VPN endpoint on a shared network or compromised Wi-Fi. The risk is elevated for environments where VPN connections are frequently established over untrusted networks. Prompt remediation mitigates the opportunity for an attacker to capture traffic or decrypt otherwise secure transmissions.