EUVD-2026-54262
GHSA-qf3w-qfqh-77ch
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Any local user can trigger it with no privileges or interaction (AV:L/PR:N/UI:N/AC:L), escalating out of context to full root control (S:C, C:H/I:H/A:H).
Primary rating from Vendor (sophos).
CVSS VectorVendor: sophos
Lifecycle Timeline
3DescriptionCVE.org
A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.
AnalysisAI
Local privilege escalation in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows any local user to execute arbitrary code with root privileges. The flaw stems from improper authorization (CWE-285) in the security agent's privileged components, so a low-privileged or unprivileged local account can fully compromise the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a macOS system running a vulnerable build - Sophos Endpoint for macOS older than 2026.1.1 or Sophos Home for macOS older than 10.11.6 - with the Sophos security agent installed and running (its privileged helper/daemon must be present, which is the default for any protected endpoint). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.3) describes a low-complexity local attack requiring no privileges and no user interaction, with a scope change reflecting escalation to root - an unusually severe LPE profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Sophos Endpoint for macOS to 2026.1.1 or later, and Sophos Home for macOS to 10.11.6 or later; managed Sophos Endpoint installations typically auto-update via Sophos Central, so verify the deployed agent version across the macOS fleet and force policy/update checks on any endpoints still below the fixed builds. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct inventory of all macOS systems running Sophos Endpoint (< 2026.1.1) and Sophos Home (< 10.11.6); restrict physical and remote access to affected systems where feasible; review system logs for evidence of unauthorized privilege escalation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users
The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrator
Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports wa
Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters i
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engin
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sop
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewa
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as e
Same weakness CWE-285 – Improper Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today