TI-2022-00020 Aliases CVE-2022-0025 GHSA-vfc6-3mw5-mv5q

Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability

LOW 29CWE-427Published 2022-05-11 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.

Summary

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts: All versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows; Cortex XDR agent 7.7.0 without content update 500 or a later version on Windows. This issue does not impact other platforms or other versions of the Cortex XDR agent.

Why it matters now

EPSS 0.00244 15th percentileScored 2026-11-07

Fix Fixed Cortex XDR Agent (Palo Alto Networks): 7.7.1.62043 without CU-500, 7.6 all, 7.5 CE all +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Palo Alto Networks	Cortex XDR Agent	7.7 to before 7.7.1.62043 without CU-500	7.7.1.62043 without CU-500	Patch available	CNA
Palo Alto Networks	Cortex XDR Agent	—	7.6 all, 7.5 CE all, 7.4 all, 7.5 all, 6.1 all, 5.0 all	Patch available	CNA

Cortex XDR Agent VendorPalo Alto Networks Affected 7.7 to before 7.7.1.62043 without CU-500 Fixed in 7.7.1.62043 without CU-500 Patch available CNA
Cortex XDR Agent VendorPalo Alto Networks Affected — Fixed in 7.6 all, 7.5 CE all, 7.4 all, 7.5 all, 6.1 all, 5.0 all Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent::::::::	7.7.0 to before 7.7.1.62043	Vulnerable	CyberArk Software, a Palo Alto Networks Company
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:* Versions 7.7.0 to before 7.7.1.62043 Vulnerable ·CyberArk Software, a Palo Alto Networks Company
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Cortex XDR Agent (Palo Alto Networks) Fixed in 7.7.1.62043 without CU-500
Fix · CNA Cortex XDR Agent (Palo Alto Networks) Fixed in 7.6 all, 7.5 CE all, 7.4 all, 7.5 all, 6.1 all, 5.0 all

Timeline

2026-10-02 Threatist record created from CVE-2022-0025
2026-10-03 Alias added: GHSA-vfc6-3mw5-mv5q

References

Advisory 1

https://security.paloaltonetworks.com/CVE-2022-0025

TI-2024-08782 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure KEVCVSS 4.0CRITICAL 9.9
TI-2024-03172 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect KEVCVSS 3.1CRITICAL 10.0
TI-2020-01936 PAN-OS: Authentication Bypass in SAML Authentication KEVCVSS 3.1CRITICAL 10.0
TI-2017-11675 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and… KEVCVSS 3.1CRITICAL 9.8
TI-2026-00239 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal KEVCVSS 4.0CRITICAL 9.3
TI-2024-08784 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure KEVCVSS 4.0CRITICAL 9.2

See all 367 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences