CVE Watch26 oct 2026

CVE-2026-0232

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable

CVSS

4.4

Medio

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 13 abr 2026 · Última mod.: 26 oct 2026 · CWE-15

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-09-302026-10-28

Descripción técnica

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.

Referencias oficiales

security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2026-0232

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-68403—

1.1%

——0An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later10d CVE-2026-110845—

26.9%

——8n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authenticated members who can point the node, including as an agent tool, at a repository whose local configuration they control can execute programs as the n8n process user.3d CVE-2026-962185.5 MED

46.0%

——14Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.13d CVE-2026-961887.3 ALT

31.5%

——9External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.16d CVE-2026-730277.8 ALT

35.6%

——11External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.21h CVE-2026-1078188.4 ALT

34.3%

——10MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.15d