CVE-2026-0248 Prisma Access Agent: Improper Certificate Validation Vulnerability

🗓️ 13 May 2026 19:05:00Reported by palo_altoType

Improper certificate validation in Prisma Access Agent for Android and Chrome operating system enables man in middle interception of VPN traffic.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-0248	13 May 202619:05	–	attackerkb
BDU FSTEC	The vulnerability of the user remote access agent for corporate resources and Prisma Access applications lies in authentication process errors, which allow attackers to execute “man-in-the-middle” attacks.	25 May 202600:00	–	bdu_fstec
Circl	CVE-2026-0248	14 May 202606:51	–	circl
CNNVD	Palo Alto Networks Prisma Access Agent 信任管理问题漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-0248	13 May 202619:05	–	cve
EUVD	EUVD-2026-30099	13 May 202621:32	–	euvd
NVD	CVE-2026-0248	13 May 202619:16	–	nvd
Positive Technologies	PT-2026-40772	13 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-0248	5 Jun 202619:25	–	redhatcve
Vulnrichment	CVE-2026-0248 Prisma Access Agent: Improper Certificate Validation Vulnerability	13 May 202619:05	–	vulnrichment

[
  {
    "vendor": "Palo Alto Networks",
    "product": "Prisma Access Agent",
    "platforms": [
      "Android",
      "Chrome OS"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "26.2.1",
        "changes": [
          {
            "at": "26.2.1",
            "status": "unaffected"
          }
        ],
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Palo Alto Networks",
    "product": "Prisma Access Agent",
    "platforms": [
      "iOS",
      "Linux",
      "macOS",
      "Windows"
    ],
    "versions": [
      {
        "status": "unaffected",
        "version": "All",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
security	www.security.paloaltonetworks.com/CVE-2026-0248

13 May 2026 19:05Current

CVSS 48.6

EPSS0.00107

CWE-295