EUVD-2026-48558
GHSA-8mrp-j364-wvp5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects.
Let's extract relevant data:
- CVE ID: CVE-2026-10610
- Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user."
- CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5)
- CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE: CWE-269 (Improper Privilege Management)
- EPSS Score: 0.14% (percentile 4%)
- Reported by: ESET
- CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:*
- Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos
- SSVC: Exploitation: none, Automatable: no, Technical Impact: total
- ENISA EUVD ID: EUVD-2026-48558
- Affected versions (EUVD):
- ESET Endpoint Security for macOS 0 ≤8.0.7200.0
- ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0
- ESET Endpoint Security for macOS 8.1 ≤8.1.200.0
- ESET Cyber Security for macOS 0 ≤9.0.5300.0
- ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0
- References:
- [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed
- [vuldb] (advisory) https://vuldb.com/vuln/382896
- [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610
We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software.
Now, we need to produce fields. Let's go through each:
- product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Eset Endpoint Security For Macos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (ESET) · only source for this CVE.
CVSS VectorVendor: ESET
DescriptionCVE.org
Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB