Vulnerability · Published Jun 12, 2024 · Assigned by palo_alto

CVE-2024-5909Cortex XDR Agent: Local Windows User Can Disable the Agent

Medium 6.8

In plain English

A medium-severity privilege mismanagement in Cortex XDR Agent from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)6.8Medium

Exploit odds (30 days)0.4%top 64.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cortex XDR Agent	8.2.0 – before 8.2.18.1.0 – before 8.1.27.9-CE – before 7.9.102-CE

Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

References

https://security.paloaltonetworks.com/CVE-2024-5909 vendor-advisory