CVE-2024-5905: 
Cortex XDR vulnerability analysis and mitigation

A vulnerability was identified in the Palo Alto Networks Cortex XDR agent on Windows devices (CVE-2024-5905) that allows a local low-privileged Windows user to disrupt some functionality of the agent. The vulnerability was disclosed on June 12, 2024, and affects multiple versions of the Cortex XDR Agent, including versions 8.2, 8.1, and 7.9-CE on Windows systems. The issue has been assigned a CVSS v4.0 base score of 2.0 (LOW severity) (Palo Advisory).

The vulnerability is classified as an Origin Validation Error (CWE-346) with a CVSS v4.0 score of 2.0. The attack vector is local (AV:L) with high attack complexity (AC:H), requiring low privileges (PR:L) and no user interaction (UI:N). The vulnerability impacts both integrity and availability at a low level (VI:L, VA:L), with no impact on confidentiality (VC:N). The attack is automatable (AU:Y) with moderate recovery effort (RE:M) (Palo Advisory).

When exploited, this vulnerability allows a local low-privileged Windows user to disrupt some functionality of the Cortex XDR agent. However, it's important to note that the vulnerability does not allow attackers to disrupt the Cortex XDR agent protection mechanisms (Palo Advisory).

The vulnerability requires local access and high attack complexity to exploit. Palo Alto Networks has stated they are not aware of any malicious exploitation of this issue in the wild (Palo Advisory).

The vulnerability has been fixed in multiple versions of the Cortex XDR agent: version 7.9.102-CE, version 8.1.2, version 8.2.1, and all later versions. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Palo Advisory).