> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/addressed-issues-in-cortex-xdr-agent-7.6.md). # Addressed Issues in Cortex XDR Agent 7.6 ### Addressed Issues in Cortex XDR Agent 7.6.3-hotfix The following has been addressed in this release: * CPATR-17371 (Windows): Fixed an issue with support file collection. ### Addressed Issues in Cortex XDR Agent 7.6.3 The following have been addressed in this release: * CPATR-16290 (MacOS): Fixed an issue for the Kernel Privilege Escalation module, which may have false positives. * CPATR-16767 (MacOS): Fixed an issue where the DMG path isn’t resolved on macOS Monterey. * CPATR-16886 (Linux): Fixed an issue where a race condition prevents Cortex XDR Process Monitor Daemon from accessing data collected by the agent. * CPATR-16755 (Linux): Fixed an issue where updating is not possible if initialization failed. * CPATR-16387 (Windows): Fixed an issue where there is a race condition preventing the agent driver from unloading. * CPATR-16377 (Linux): Fixed an issue where working with an external name resolution service may result in the service crashing. * CPATR-16354: Fixed an issue where the agent is shown as disabled on the firewall providers list in WSC. * CPATR-16300: Fixed an issue where support exception expiration is not working as expected. * CPATR-16106: Fixed an issue where agent restart prevents the new payload version from updating. * CPATR-15771: Fixed an issue where a delay in accessing a file may be caused due to a misconfigured verdict. * CPATR-15545: Fixed an issue where the agent does not detect that a scan was running before it was restarted. * CPATR-14814: Fixed an issue where non-UTF-8 characters cause the hash verdict to be stored incorrectly. * CPATR-16865: Fixed an issue where a change in OS on an endpoint is not updated in the All Endpoints table. * CPATR-16785: Fixed an issue where upgrades are not successful or some services don't start correctly because old files could not be removed. * CPATR-15156: Fixed an issue where performing a File Search action on an EDR-supported file type without destroying the file, results in a no file\_results report being sent to the server and the action is stuck on In Progress. * CPATR-16842: Fixed an issue while working with a support exception that disables injection. Any restart to pmd results in a reboot loop. ### Addressed Issues in Cortex XDR Agent 7.6.2-hotfix The following has been addressed in this release: * CPATR-16539: Fixed an issue addressing vulnerability CVE-2022-0778 Affected versions: < 7.6.2.60545 on Windows, < 7.6.2.2311 on macOS, < 7.6.2.59612 on Linux ### Addressed Issues in Cortex XDR Agent 7.6.2 The following have been addressed in this release: * CPATR-15591: Fixed an issue where the agent TMP folder fills up. * CPATR-15041 (MacOS): Fixed an issue where uninstall of MacOS agent can fail due to the database structure. * CPATR-15752 (MacOS): Fixed an issue where setting the malware profile to block on MacOS may cause instability on the machine. * CPATR-15613 (MacOS): Fixed an issue where the Host Firewall on MacOs machines may halt agent communication. * CPATR-15591 (Linux): Fixed an issue where the payload executer unexpectedly reports dual errors for the same execution resulting in incorrect handling of the original error message. * CPATR-15041 (MacOS): Fixed an issue where uninstall of MacOS agent can fail due to the database structure. ### Addressed Issues in Cortex XDR Agent 7.6.1 The following have been addressed in this release: * CPATR-15441: Fixed an issue where the agent is using a large amount of disk space. * CPATR-15310 (Windows): Fixed an issue where the agent fails to first query the hardware ID. * CPATR-15300 (Linux): Fixed an issue with log file folder permissions. * CPATR-14698: Fixed an issue Search Collection searches run multiple times. * CPATR-15445 (Windows): Fixed an issue where an Azure virtual desktop is detected as Endpoint Type: Server. * CPATR-15041 (MacOS): Fixed an issue where in some cases cannot uninstall MacOS agents. * CPATR-15207 (MacOS): Fixed an issue where when adding an IP address range to the Host Firewall configuration, the IP address is not included in the range. * CPATR-15211 (Linux): Fixed an issue where when upgrading the agent, the agent does not send audit logs. * CPATR-15300 (Linux): Fixed an issue with log file folder permissions. * CPATR-15407 (Linux): Fixed an issue with validation of Distribution ID registration. * CPATR-15310 (Windows): Fixed an issue where the agent fails to first query the hardware ID. * CPATR-15252 (Windows): Fixed an issue where when querying HWID changes, NULL value is ignored. * CPATR-15228: Fixed an issue where agent crashes when deleting by hash more than the maximum configured number of file. * CPATR-15441 (Windows): Fixed an issue where the agent is using a large amount of disk space. * CPATR-15300 (Linux): Fixed an issue with log file folder permissions. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/7.x/7.6-eol/addressed-issues-in-cortex-xdr-agent-7.6.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.