CVE-2026-0235: palo alto networks prisma browser
CVSS: 5.8v4.0MediumAnalyzed
Published 13-05-2026Last modified 14-05-2026
Vulnerability summary
CVE-2026-0235 is a medium (CVSS 5.8) vulnerability in palo alto networks prisma browser. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.2% of scored vulnerabilities.
CVSS score
5.8/10
010
Medium · v4.0 (CVE.org)EPSS score
0.11%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.8Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:AmberSourcesAll 2 agree
- NVDNIST5.8MediumCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Medium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
0.00 pp
From 0.11% on 21-09-2026
21-09-202621-10-2026
EPSS score0.11%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Palo alto networks1 product
- prisma browser< 146.16.6.165
Paloaltonetworks1 product
- prisma_browser< 146.10.7.154
2 vendors · 2 products
References
1 links- security.paloaltonetworks.com/CVE-2026-0235Vendor Advisory