CVE-2026-0232
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable
CVSS
4.4
Medium
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Published: Apr 13, 2026 · Last modified: Oct 26, 2026 · CWE-15
0.1%EPSS · 30 days0.1%
2026-09-302026-10-28
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-68403—1.1%
——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system.
We have already fixed the vulnerability in the following version:
QuRouter 2.7.2.113 and later10dCVE-2026-110845—26.9%
——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.3dCVE-2026-962185.5 MED46.0%
——14Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.13dCVE-2026-961887.3 HIG31.5%
——9External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.16dCVE-2026-730277.8 HIG35.6%
——11External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.20hCVE-2026-1078188.4 HIG34.3%
——10MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.15d