CVE-2025-0112 — Cortex XDR Agent: Local Windows User Can Disable the Agent

CVE-2025-0112

Cortex XDR Agent: Local Windows User Can Disable the Agent PUBLISHED

Description (CNA)

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.

Affected (CNA)

Vendor / product	Versions
Palo Alto Networks / Cortex XDR Agent	affected 8.3-CE before 8.3.101-CE; affected 8.4.0; affected 8.5.0 before 8.5.1; unaffected 8.6.0

CWE

CWE-754

References

https://security.paloaltonetworks.com/CVE-2025-0112

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.