EUVD-2026-36761
GHSA-3wx9-p98r-g7qr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user access on managed Mac
-
DeliveryIdentify Kandji Agent IPC surface
-
ExploitCraft request bypassing client-side validation
-
ExecutionInvoke restricted privileged agent function
-
PersistExecute actions as agent root context
-
ImpactEscalate to full device control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution on a macOS endpoint running a vulnerable Kandji Agent build earlier than 4.7.5(5374); remote network exploitation is not possible per the CVSS AV:L vector. The flaw is gated on the presence of the Kandji Agent itself (so only Kandji-managed Macs are exposed) and on the client-side validation path that the agent uses to gate restricted functionality. Limiting factors: the attacker needs an existing foothold on the device (standard user account or running process), the target must be a Kandji-managed Mac, and the agent must be on an unpatched build - fully patched endpoints (4.7.5(5374)+) are not exposed. |
| Impact | The CVSS vector (AV:L/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a low-complexity local attack with no privileges or user interaction required, yielding high impact across all three pillars - consistent with full privilege escalation to the agent's root context on a managed endpoint. However, the very low EPSS score (0.14%, 4th percentile) and the absence of KEV listing or any public POC suggest no widespread exploitation is occurring; real risk is bounded by the requirement for prior local access to a Kandji-managed Mac. The PR:N choice in the vendor vector is debatable for a local escalation flaw - a logged-in unprivileged user normally counts as PR:L - but the underlying signal remains: any code running on the endpoint can likely abuse the agent's privileges, which is significant for fleets where endpoints handle untrusted content or multiple users. |
| Exploit ScenarioDerived | An attacker with an unprivileged local shell on a Kandji-managed Mac - for example a standard user account, a compromised low-privilege process, or a malicious insider - sends crafted requests to the local Kandji Agent that bypass its client-side validation and invoke restricted privileged functions. The result is execution of management-plane actions (such as installing arbitrary packages, modifying configurations, or running scripts as root) under the agent's elevated context, effectively escalating from a standard user to administrative control over the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Local privilege escalation in Iru, Inc Kandji Agent versions prior to 4.7.5(5374) allows a local attacker to invoke restricted agent functionality by exploiting a client-side validation gap. The flaw maps to CWE-269 (Improper Privilege Management) and carries a CVSS 8.4 rating due to high impact on confidentiality, integrity, and availability, though no public exploit identified at time of analysis and EPSS is low at 0.14%.
RemediationAI
Vendor-released patch: Kandji Agent 4.7.5(5374) - upgrade all managed endpoints to this build or later as documented at https://www.iru.com/updates/2026/03/agent-4-7-5-5374, with cross-reference at https://nvd.nist.gov/vuln/detail/CVE-2026-39118. Because Kandji centrally pushes agent updates, administrators should confirm the rollout has reached 100% of the managed fleet and audit endpoints that may have missed the update window (offline laptops, suspended devices). As a compensating control until patching completes, restrict interactive local access to managed Macs (limit secondary user accounts, enforce screen-lock and FileVault, and tighten remote-shell access such as SSH and ARD) so that an attacker cannot run code locally to trigger the flaw; the trade-off is reduced helpdesk flexibility, not a true mitigation of the vulnerability itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kandji Agent is the macOS endpoint client component of the Kandji device-management platform, running with elevated privileges to enforce policies, install software, and manage configurations on managed Apple devices. The root cause is CWE-269 (Improper Privilege Management): the agent relies on client-side validation to gate access to privileged internal functions, meaning a local actor on the endpoint can bypass these checks and invoke restricted agent operations that should be reserved for the trusted management plane. CPE data is unhelpful here (listed as 'n/a:n/a'), but the vendor URL identifies the affected component unambiguously as the Kandji macOS agent prior to build 4.7.5(5374).
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requires an existing logged-in/unprivileged process on the managed Mac, so PR:L (not PR:N); low complexity yields full C/I/A impact in the agent's root context.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.
Executive ViewAI
Kandji Agent versions prior to 4.7.5(5374) contain a local privilege escalation vulnerability enabling device users to escalate permissions and compromise endpoint security, including data confidentiality and integrity. Organizations running affected Kandji versions should prioritize upgrading to protect managed device estates and reduce insider threat exposure.
Vendor-released patch: Kandji Agent 4.7.5(5374)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB