The vulnerability is a local privilege escalation flaw present in the Palo Alto Networks Prisma Access Agent on Windows and macOS operating systems. An authenticated local user who is able to run arbitrary code can exploit improper handling of system paths or environment variables, as identified by CWE-427, to execute code with elevated privileges. This allows the attacker to compromise the integrity of the affected device and potentially gain full control of the system.

Prisma Access Agent versions 24.0 through 26.2.2 on Windows and macOS are susceptible. The agent on Linux, iOS, Android, and ChromeOS is not affected. Administrators should review installed versions and ensure they fall below the vulnerable range only when no remediation can be applied, although the recommended approach is to upgrade.

The CVSS score of 6 indicates medium severity, and no EPSS data is available. The flaw is not listed in the CISA KEV catalog, implying no known widespread exploitation to date. The attack requires local access; once a local user can execute code, the flaw provides a path to elevate privileges to high system levels. Administrators should treat this as a medium risk that can enable a local attacker to compromise device integrity.