Palo Alto Networks Patches Cortex XDR and Prisma Browser Vulnerabilities

Palo Alto Networks published security advisories addressing multiple vulnerabilities affecting Cortex XDR components and Prisma Browser, including CVE-2026-0230 (macOS Cortex XDR Agent can be disabled by a local administrator) and CVE-2026-0231 (Cortex XDR Broker VM information disclosure). For CVE-2026-0230, Palo Alto Networks reported a protection-mechanism issue on macOS that could allow malware to operate without detection if a local admin disables the agent; affected versions include Cortex XDR Agent 8.7-CE prior to 8.7.101-CE and 8.3-CE prior to 8.3.102-CE on macOS, with Palo Alto Networks stating it is not aware of in-the-wild exploitation. For CVE-2026-0231, an authenticated user with network access to the Broker VM could obtain and modify sensitive information by triggering a live terminal session via the Cortex UI and changing configuration settings; the issue affects Cortex XDR Broker VM 30.0.0 prior to 30.0.49, and Palo Alto Networks stated there are no workarounds and that upgrading is required.

Palo Alto Networks also released PAN-SA-2026-0003, incorporating upstream Chromium security fixes into Prisma Browser and listing multiple Chromium CVEs (including CVE-2026-2314, CVE-2026-2321, and CVE-2026-2441); Prisma Browser versions prior to 145.7.9.76 are affected and should be updated. The Canadian Centre for Cyber Security echoed these Palo Alto Networks advisories and urged organizations to apply the necessary updates and mitigations. A separate Canadian advisory covered Splunk product vulnerabilities across Splunk Enterprise, Splunk Cloud Platform, and multiple AppDynamics agents, but it is unrelated to the Palo Alto Networks Cortex/Prisma issues.