Security readout for executives and security teams
Plain-English summary
This issue lets a low-privileged local Windows user read files with elevated privileges when Palo Alto Networks Cortex XDR Agent generates a tech support file. It is not described as remote code execution, but it can expose sensitive local data.
Executive priority
Treat as a moderate-priority endpoint data exposure issue. Remediate through normal patch governance, prioritizing shared workstations, high-value systems, and environments where non-admin local users can access sensitive files indirectly.
Technical view
CVE-2022-0029 is a CWE-59 improper link resolution flaw in Cortex XDR Agent for Windows. The CVSS 3.1 vector is local, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact only.
Likely exposure
Exposure is limited to Windows endpoints running the listed Cortex XDR Agent versions where a local authenticated attacker can interact with the system. Confirm exact vulnerable and fixed version status in Palo Alto guidance because the provided bundle’s version list is ambiguous.
Exploitation context
The source bundle does not indicate CISA KEV listing or active exploitation. The attack requires local access and low privileges, and the documented impact is reading files with elevated privileges during tech support file generation.
Researcher notes
Key evidence supports local privilege-assisted file read, not remote compromise or code execution. The version data in the bundle appears inconsistent, so validation should rely on the Palo Alto advisory before declaring systems vulnerable or remediated.
Mitigation direction
- Review Palo Alto Networks advisory for affected and fixed Cortex XDR Agent versions.
- Prioritize upgrading or applying vendor-recommended fixes on Windows endpoints.
- Restrict local user access on endpoints where agent updates are delayed.
- Control and monitor tech support file generation workflows.
Validation and detection
- Inventory Windows endpoints running Cortex XDR Agent.
- Compare installed agent versions against Palo Alto’s advisory.
- Check whether tech support file generation is available to low-privileged users.
- Review local endpoint logs for unusual tech support package creation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-0029 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://security.paloaltonetworks.com/CVE-2022-0029CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.