Palo Alto Networks Security Advisories / CVE-2024-5909

CVE-2024-5909 Cortex XDR Agent: Local Windows User Can Disable the Agent

Severity 6.8 · MEDIUM
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector LOCAL
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction NONE
Product Confidentiality NONE
Product Integrity NONE
Product Availability HIGH
Privileges Required LOW
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE


A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.

Product Status

Cortex XDR Agent 8.4NoneAll
Cortex XDR Agent 8.3NoneAll
Cortex XDR Agent 8.2< 8.2.1 on Windows>= 8.2.1 on Windows
Cortex XDR Agent 8.1< 8.1.2 on Windows>= 8.1.2 on Windows
Cortex XDR Agent 7.9-CE< 7.9.102-CE on Windows>= 7.9.102-CE on Windows

Severity: MEDIUM

CVSSv4.0 Base Score: 6.8 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type

CWE-269 Improper Privilege Management


This issue is fixed in Cortex XDR agent 7.9.102-CE, Cortex XDR agent 8.1.2, Cortex XDR agent 8.2.1, and all later Cortex XDR agent versions.


Palo Alto Networks thanks Manuel Feifel of VUREX (InfoGuard AG) for discovering and reporting this issue.


Initial publication
© 2024 Palo Alto Networks, Inc. All rights reserved.