CVE-2024-5907: Privilege Escalation in Cortex XDR Agent

Successful exploitation of CVE-2024-5907 could grant an attacker elevated privileges on a compromised Windows system running the Cortex XDR agent. This could allow them to bypass security controls, install malware, access sensitive data, and potentially move laterally within the network. While the race condition requirement makes exploitation difficult, a determined attacker with sufficient access and knowledge could potentially achieve significant compromise. The potential impact includes data exfiltration, system takeover, and disruption of operations.

1. Reserved2024-06-12
2. Published2024-06-12
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5907 is to upgrade the Palo Alto Networks Cortex XDR agent to a version that includes the fix. Palo Alto Networks has not released a specific fixed version in the provided data. Until a fixed version is available, consider implementing stricter local account privilege controls and monitoring for suspicious process execution. Review and harden existing security policies to minimize the potential impact of a successful exploit. After upgrading, confirm the agent version to ensure the fix has been applied successfully by checking the agent's 'About' section.