EUVD-2026-66331Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local attack requiring a low-privileged session; deterministic PIN derivation and XPC identity spoofing yield full administrator scope change with complete C/I/A impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
AnalysisAI
Privilege escalation in Admin By Request (ABR) for macOS allows a low-privileged local user to obtain full administrator rights by exploiting a predictable PIN derivation mechanism via Apple's Cross-Process Communication (XPC) framework. The attacker masquerades as an Apple-signed process during XPC communication, bypassing ABR's authentication logic entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, authenticated session as a low-privileged (non-administrator) macOS user on a host where Admin By Request (ABR) is installed and its privileged daemon is running - which is the product's default operational state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a locally exploitable, low-complexity attack requiring only a standard user account - a realistic baseline in any enterprise macOS fleet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A standard macOS user with a local shell session reverse-engineers or predicts the PIN derivation algorithm used by ABR, then crafts an XPC message that presents a spoofed Apple-signed process identity to ABR's privileged daemon. ABR validates the spoofed code signature and accepts the attacker-supplied PIN, escalating the user session to full administrator without any interaction from a legitimate admin or end-user. … |
| Remediation | Apply the fix detailed in the vendor security advisory at https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm - no exact patched version number was present in the input data, so the advisory must be consulted directly to confirm the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all macOS systems running Admin By Request and quantify business impact if ABR access controls are circumvented. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Admin By Request Abr
View allSame weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today