Loading vulnerability…
Local admin can disable Palo Alto Networks Cortex XDR Agent on macOS
A protection mechanism weakness in the Palo Alto Networks Cortex XDR agent for macOS allows a local administrator to disable the agent. This can be leveraged by malware or an attacker with local administrative privileges to turn off endpoint protection and operate without detection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A local administrator (including malware that has obtained admin privileges) can disable the Cortex XDR agent on macOS, reducing or eliminating endpoint detection/response visibility and enabling malicious activity to proceed without being detected by the agent.
If you can’t patch tonight, do this now.
Ensure Cortex XDR Agent for macOS is updated to remediated versions. Until updates can be applied, reduce the likelihood of exploitation by limiting and monitoring local administrator privileges on macOS endpoints (e.g., least privilege, auditing/admin access controls), since exploitation requires local admin access.
Patch, then assume compromise.
Update Cortex XDR Agent for macOS to a fixed version. Affected versions include Cortex XDR Agent 8.7-CE prior to 8.7.101-CE and 8.3-CE prior to 8.3.102-CE; upgrade to 8.7.101-CE / 8.3.102-CE or later as provided by Palo Alto Networks advisories.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.