Palo Alto Networks discloses medium-severity information leak in Prisma Access Agent for Linux

Palo Alto Networks has published a security advisory for CVE-2026-0305, a medium-severity vulnerability affecting the Prisma Access Agent on Linux systems. The flaw allows a local user with low privileges to access sensitive configuration data and credentials stored by the agent. The issue carries a CVSS v4.0 base score of 4.3 and is classified as an information disclosure weakness (CWE-200).

According to the advisory, only Linux installations of the Prisma Access Agent are impacted; versions on macOS, Windows, iOS, Android, and Chrome OS are unaffected. Affected Linux versions include 25.7 through 26.2.2, and the vendor recommends upgrading to version 26.3 or later to remediate the issue. No special configuration is required for a system to be exposed, and there are currently no known workarounds or mitigations besides applying the update.

Palo Alto Networks states that it discovered the vulnerability internally and is not aware of any malicious exploitation in the wild. The attack vector is local, with low complexity and no user interaction required, but it does require an attacker to already have low-privilege access on the host. Given the potential exposure of credentials and configuration details, organizations running the agent on Linux should prioritize patching as part of routine vulnerability management. The advisory was initially published on September 9, 2026, and includes references to the official CVE record and vendor guidance.