CVE-2024-8690
Cortex XDR Agent: Local Windows Administrator Can Disable the Agent
Exploited
Not listed
EPSS
0.002
7.7th percentile
Discovered by
Third party
Vendor-published field
Published
Sep 11, 2024
Assigned by palo_alto
Description
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
Weakness: CWE-440
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Palo Alto Networks · Cortex XDR Agent
Credit
Ayman Sagy of CyberCX
Vendor remediation
This issue is fixed in Cortex XDR Agent 8.2, and all later Cortex XDR Agent versions.