What is CVE-2026-0230?

CVE-2026-0230 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. CVE-2026-0230 Cortex XDR Agent: Local Administrator can disable the agent on macOS

Which CVE IDs does CVE-2026-0230 cover?

CVE-2026-0230 covers the following CVE IDs: CVE-2026-0230. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2026-0230?

CVE-2026-0230 affects 1 product, including: Cortex XDR Agent.

CVE-2026-0230Medium

CVE-2026-0230 Cortex XDR Agent: Local Administrator can disable the agent on macOS

Vendor

Palo Alto Networks Security Advisories

Published

March 11, 2026

Last Modified

March 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-0230 →

📋 Description

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This issue could be leveraged by malware to perform malicious activity without detection.

🎯 Affected products1

Cortex XDR Agent

✅ Remediation

This issue is fixed in Cortex XDR Agent 8.9.0, Cortex XDR Agent 8.7.101-CE, Cortex XDR Agent 8.3.102-CE, and all later Cortex XDR Agent versions.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/CVE-2026-0230