Dashboard / CVE-2026-0248

CVE-2026-0248

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 57/100
Published: 2026-05-13 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: High
VA: None

Description

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
paloaltonetworks prisma_access_agent < 26.2.1

References & Advisories (1)

Bug Bounty Relevance

57 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.2 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber

EPSS — Exploitation Probability

0.19%
Raw Score 0.001880
Percentile 8.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00188
2026-10-28
0.00188

Intelligence Sources

nvd ref →

External Links