CVE-2022-0015

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 0.24%
EPSS Percentile: 14.74%
CISA KEV: Not listed

Description

A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 13-Jan-2022 01:15
Last Modified: 17-Jun-2026 11:19
EPSS Date: 2026-11-08
CWE: CWE-427

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

Palo Alto Networks · Cortex XDR Agent Source: CNA · [email protected]
Default status: unknown

7.2.* — unaffected
7.3.* — unaffected
7.4.* — unaffected
7.5.* — unaffected
7.6.* — unaffected
5.0 ≤ version < 5.0.12 — affected (custom); at 5.0.12: unaffected
6.1 ≤ version < 6.1.9 — affected (custom); at 6.1.9: unaffected

Affected Products / Versions

paloaltonetworks / cortex_xdr_agent Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0 · before (exclusive) 5.0.12
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*
paloaltonetworks / cortex_xdr_agent Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.1 · before (exclusive) 6.1.9
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*

References

af854a3a-2127-422b-91ae-364da2661108

Last enrichment sync: 09-Nov-2026 11:25
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

and vulnerable. Just recently, Palo Alto Networks published that Cortex XDR agents are vulnerable to CVE-2022-0015, a privilege escalation vulnerability that enables authenticated local users to execute programs with Why Endpoint Security Agents Alone Fall Short in Cloud Environments

CVE (1)

Malware (1)

Vendors (6)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.