CVE-2026-0293

This CVE exposes a gap between what Palo Alto marketed as cross-platform anti-tamper protection and what the Windows implementation actually delivers. The Linux and macOS Prisma agents have functional tamper resistance; the Windows version does not. That asymmetry isn't a minor implementation detail — it's a structural failure that undermines the entire deployment's security model. The CVSS 5.6 score itself is revealing. It reflects a local-only attack requiring administrator privileges, which tells you exactly what Palo Alto's threat model for this feature actually was: stop commodity malware and accidental misconfiguration, not an attacker who already holds elevated local access. That framing would be acceptable if disclosed — but the marketing position of 'anti-tamper protection' implies stronger guarantees than the Windows implementation delivers. The documentation gap is the real vulnerability here, not just the bypass itself. For defenders, the practical implications are specific to how Prisma Access fits into your architecture. If you're running Windows endpoints as part of a Zero Trust deployment where the Prisma agent is a policy enforcement point, understand that the protective layer you relied on for those nodes doesn't exist in the same form as it does on Unix endpoints. The agent still runs, still enforces policy, still terminates traffic at the tunnel — but the tamper-resistance that was supposed to prevent injection into that agent is absent on Windows. Check your deployment inventory now. Know which nodes are Windows and which are Linux/macOS. Understand that a local admin compromise on a Windows Prisma endpoint can directly target the agent without triggering the anti-tamper defenses that exist on your other platforms. This changes the risk calculus for that node class — treat it as a softer target in your threat model, not as equivalent to the others. The compensating control is architectural segregation: don't assume the Windows Prisma agent provides the same integrity guarantees as the Unix variants, and segment accordingly. The remediation timeline matters more than the CVSS suggests. Windows API fragmentation across versions means detection signatures won't cleanly port, and the bypass doesn't generate obvious forensic artifacts. You may not know this was exploited until something else surfaces it. Assume a compound exposure window — time to patch plus time to build compensating controls — during which the exploitation would be invisible.

Reviewed through automated stages and approved by a human before publication.