Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-0112
CVE-2025-0112:
Cortex XDR vulnerability analysis and mitigation
Overview
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability (CVE-2025-0112) was discovered internally by Eldar Aharoni of Palo Alto Networks and publicly disclosed on February 12, 2025. The vulnerability affects multiple versions of Cortex XDR Agent on Windows, including versions 8.3-CE, 8.4, 8.5, and 8.6 (Palo Alto).
Technical details
The vulnerability has been assigned a CVSS Base Score of 4.3 (MEDIUM) with the following vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U/V:D/U:Amber. The weakness is categorized as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CAPEC-578 (Disable Security Software). The vulnerability requires local access and low privileges to exploit, with no user interaction needed (Palo Alto).
Impact
If exploited, this vulnerability allows non-administrative Windows users to disable the Cortex XDR agent. More critically, malware can leverage this vulnerability to disable the security agent and subsequently perform malicious activities without detection (Palo Alto).
Mitigation and workarounds
The vulnerability has been fixed in Cortex XDR agent versions 8.3.101-CE, 8.5.1, 8.6, and all later versions. There are no known workarounds or alternative mitigations for this issue (Palo Alto).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management