CVE-2020-2049

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XDR Agent versions 7.1 with content update 149 and earlier versions Palo Alto Networks Cortex XDR Agent versions 7.2 with content update 149 and earlier versions

Description A local privilege escalation issue exists in Palo Alto Networks Cortex XDR Agent on the Windows platform, allowing an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory.

Recommendations For versions 7.1 with content update 149 and earlier versions, update to a version with a content update later than 149 to resolve the issue. For versions 7.2 with content update 149 and earlier versions, update to a version with a content update later than 149 to resolve the issue. As a temporary workaround, consider restricting access to the Windows root directory to prevent users from creating files in this location, thereby minimizing the risk of exploitation.