The vulnerability of the command-line interface of the network traffic analysis and detection tool, Cortex XDR Agent, for operating systems based on Windows, allows a perpetrator to execute arbitrary commands.

The vulnerability of the command-line interface of the network traffic analysis, network detection, and response tool Cortex XDR Agent for Windows operating systems is related to a breach of the data protection mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary...

CVE-2023-0001

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

CVE-2023-0002

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

CVE-2023-0002

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

CVE-2023-0001

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

Information disclosure

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

Command injection

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

CVE-2023-0002

CVE-2023-0002 affects the Palo Alto Networks Cortex XDR Agent on Windows. The issue stems from a protection mechanism flaw that allows a local user to execute privileged cytool commands, enabling the local user to disable or uninstall the Cortex XDR agent. Documented impact is the potential disru...

CVE-2023-0002 Cortex XDR Agent: Product Disruption by Local Windows User

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

CVE-2023-0002 Cortex XDR Agent: Product Disruption by Local Windows User

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent...

CVE-2023-0001 Cortex XDR Agent: Cleartext Exposure of Agent Admin Password

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

CVE-2023-0001

CVE-2023-0001 concerns the Palo Alto Networks Cortex XDR agent on Windows, where an information-exposure flaw lets a local administrator disclose the agent’s admin password in cleartext. This password leakage can be used to run privileged cytool commands that disable or uninstall the agent. Publi...

Cortex XDR Agent: Cleartext Exposure of Agent Admin Password

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agen...

Cortex XDR Agent: Product Disruption by Local Windows User

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent. Work around: There are no known workarounds for this issue...

Palo Alto Networks Cortex XDR 安全漏洞

Palo Alto Networks Cortex XDR is an extended detection and response platform that natively integrates network, endpoint, cloud, and third-party data from Palo Alto Networks, USA. A security vulnerability exists in Palo Alto Networks Cortex XDR that originates from a local user executing a...

PT-2023-1382 · Palo Alto Networks · Cortex Xdr Agent

Name of the Vulnerable Software and Affected Versions: Cortex XDR Agent versions affected versions not specified Description: The issue is related to a problem with a protection mechanism in the Cortex XDR agent on Windows devices, allowing a local user to execute privileged commands. This can...

XDR, the Beatles, and Blunt Instruments

Sometimes tools are blunt because there’s nothing else. Regarding economic controls for example, Fed Chair Jerome Powell said: “We have essentially interest rates, the balance sheet and forward guidance. They are famously blunt tools, they are not capable of surgical precision." Others are blunt...

Auditing Kubernetes with Open Source SIEM and XDR

Container technology has gained traction among businesses due to the increased efficiency it provides. In this regard, organizations widely use Kubernetes for deploying, scaling, and managing containerized applications. Organizations should audit Kubernetes to ensure compliance with regulations,...

Microsoft Security innovations from 2022 to help you create a safer world today

The start of a new year is always a great time for reflection—to be grateful for all we have and the progress security teams have made as well as look ahead to how we can reshape the security landscape. I use this time to think about goals for the future, and to reflect on the highlights,...

What’s New in InsightIDR: Q4 2022 in Review

As we continue to empower security teams with the freedom to focus on what matters most, Q4 focused on investments and releases that contributed to that vision. With InsightIDR, Rapid7’s cloud-native SIEM and XDR solution, teams have the scale, comprehensive contextual coverage, and expertly vett...