There is a local privilege escalation vulnerability in Prisma Access Agent running on Linux. A user with local device access can run arbitrary code with privileged rights, potentially attaining root level control. The flaw is a missing permission check (CWE‑732) that permits a privileged user to bypass security boundaries and execute code beyond their authorized scope.

Affected versions are Palo Alto Networks Prisma Access Agent for Linux from 25.7 through 26.2.0. Versions after 26.2.1 are not impacted, and the vulnerability does not affect Windows, macOS, iOS, Android, or ChromeOS deployments.

The CVSS score is 5.9, indicating moderate risk; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires local access by an authorized user, so the attack vector is local. No publicly documented exploitation or workaround exists beyond the remediation release.