CVE-2025-0112
Cortex XDR Agent: Local Windows User Can Disable the Agent
Exploited
Not listed
EPSS
0.002
9.1th percentile
Discovered by
Vendor
Vendor-published field
Published
Feb 19, 2025
Assigned by palo_alto
Description
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.
Weakness: CWE-754
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Palo Alto Networks · Cortex XDR Agent
Credit
Eldar Aharoni of Palo Alto Networks
Vendor remediation
This issue is fixed in Cortex XDR agent 8.3.101-CE, Cortex XDR agent 8.5.1, Cortex XDR agent 8.6 and all later Cortex XDR agent versions.