Lucene search

Palo Alto Networks Product Security Incident Response TeamPA-CVE-2024-8690

HistorySep 11, 2024 - 4:00 p.m.

Cortex XDR Agent: Local Windows Administrator Can Disable the Agent

2024-09-1116:00:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

cortex xdr

windows

administrator privilege

disable

malware

vulnerability

CVSS4

5.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/SC:N/VI:H/SI:N/VA:N/SA:L/AU:N/U:Amber/R:U/V:D/RE:M

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.6%

JSON

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.

Work around:
No work around available.

References

security.paloaltonetworks.com/CVE-2024-8690