Prisma Access
CVE-2026-0291: Authenticated Limited File Deletion on Linux
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Prisma Access Agent (Linux) 0 | 26.2.2 or later |
| Prisma Access Agent (macOS, Windows, iOS, Android, Chrome OS) | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.
The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds or mitigations exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.