CVE-2026-0277— Prisma Access Agent: Improper Certificate Validation on iOS
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent | < 26.2.1 | affected |
All | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-0277
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prisma Access Agent: Improper Certificate Validation on iOS
Source: NVD (National Vulnerability Database)
Vulnerability Description
An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
证书验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Palo Alto Networks Prisma Access Agent 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Palo Alto Networks Prisma Access Agent是美国Palo Alto Networks公司的代理接入安全客户端。 Palo Alto Networks Prisma Access Agent 26.2.1之前版本存在加密问题漏洞，该漏洞源于证书验证不当，可能导致攻击者执行中间人攻击以拦截VPN流量。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent | 0 ~ 26.2.1 | - | |
| Palo Alto Networks | Prisma Access Agent | - | - |
II. Public POCs for CVE-2026-0277
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0277
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-0277 (1)
Same Patch Batch · Palo Alto Networks · 2026-07-09 · 13 CVEs total
| CVE-2026-0275 | Prisma Browser: Local Privilege Escalation on macOS | |
| CVE-2026-0276 | Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability | |
| CVE-2026-0278 | Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows | |
| CVE-2026-0279 | PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | |
| CVE-2026-0280 | PAN-OS: IPv6 Firewall Policy Bypass | |
| CVE-2026-0281 | PAN-OS: Information Disclosure Vulnerability in Management Web Interface | |
| CVE-2026-0282 | PAN-OS: File Deletion Vulnerability in Management Web Interface | |
| CVE-2026-0283 | PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) | |
| CVE-2026-0284 | PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) | |
| CVE-2026-0285 | PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | |
| CVE-2026-0286 | PAN-OS: Authenticated Command Injection in CLI | |
| CVE-2026-0287 | PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing |
IV. Related Vulnerabilities
Same product: Prisma Access Agent
- CVE-2026-0278
Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilit - CVE-2026-0271
Prisma Access Agent: Local Privilege Escalation by Authorize - CVE-2026-0268
Prisma Access Agent: Local Authenticated VPN Enforcement Byp - CVE-2026-0248
Prisma Access Agent: Improper Certificate Validation Vulnera - CVE-2026-0245
Prisma Access Agent: Information Disclosure Vulnerabilities
Same vendor: Palo Alto Networks
- CVE-2026-0275
Prisma Browser: Local Privilege Escalation on macOS - CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerabilit - CVE-2026-0278
Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilit - CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities - CVE-2026-0280
PAN-OS: IPv6 Firewall Policy Bypass
Same weakness: CWE-295
- CVE-2026-13410
Dancer::Plugin::Auth::Google versions through 0.07 for Perl - CVE-2026-50302
Windows Cryptographic Services Security Feature Bypass Vulne - CVE-2026-47632
Azure Monitor Agent Metrics Extension Elevation of Privilege - CVE-2026-55001
Active Directory Domain Services Elevation of Privilege Vuln - CVE-2026-59836
Fortinet FortiClientEMS 加密问题漏洞
V. Comments for CVE-2026-0277
No comments yet