CVE-2020-2049— Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-2049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation
Source: NVD (National Vulnerability Database)
Vulnerability Description
A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对搜索路径元素未加控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Palo Alto Networks Cortex XDR Agent 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Palo Alto Networks Cortex XDR Agent是马来西亚Palo Alto Networks公司的一个用于检测客户端设备安全性的客户端软件。 Palo Alto Networks Cortex XDR 存在安全漏洞，该漏洞源于在Windows平台上的代理中存在一个本地特权升级漏洞，该漏洞允许经过身份验证的本地Windows用户使用系统特权执行程序。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Palo Alto Networks | Cortex XDR Agent | 7.1.* with content update 150 | - | |
| Palo Alto Networks | Cortex XDR Agent | 6.1.* with latest content | - |
II. Public POCs for CVE-2020-2049
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-2049
请登录查看更多情报信息。
- https://security.paloaltonetworks.com/CVE-2020-2049x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-2049
IV. Related Vulnerabilities
Same product: Cortex XDR Agent
- CVE-2026-0232
Cortex XDR Agent: Local Administrator can disable the agent - CVE-2026-0230
Cortex XDR Agent: Local Administrator can disable the agent - CVE-2025-0121
Cortex XDR Agent: Local Windows User Can Crash the Agent - CVE-2025-0112
Cortex XDR Agent: Local Windows User Can Disable the Agent - CVE-2024-9469
Cortex XDR Agent: Local Windows User Can Disable the Agent
Same vendor: Palo Alto Networks
- CVE-2026-0300
PAN-OS: Unauthenticated user initiated Buffer Overflow Vulne - CVE-2026-0232
Cortex XDR Agent: Local Administrator can disable the agent - CVE-2026-0233
Autonomous Digital Experience Manager: Improper validation o - CVE-2026-0234
Cortex XSOAR: Improper Verification of Cryptographic Signatu - CVE-2026-0231
Cortex XDR Broker VM: Sensitive Information Disclosure Vulne
Same weakness: CWE-427
- CVE-2026-44406
DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartvie - CVE-2026-40004
openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud - CVE-2026-21661
AC2000 Uncontrolled Search Path Element - CVE-2026-6788
Uncontrolled search path in PluginLauncher allows SYSTEM cod - CVE-2026-25852
Acronis DeviceLock DLP 代码问题漏洞
V. Comments for CVE-2020-2049
No comments yet