EUVD-2026-66331
GHSA-733c-6w54-grpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged macOS user session
-
DeliveryAnalyze and predict insecure PIN derivation logic
-
ExploitForge Apple-signed process identity for XPC
-
ExecutionSend crafted XPC message to ABR privileged daemon
-
PersistABR accepts spoofed identity and derived PIN
-
ImpactFull administrator privileges granted
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local, authenticated session as a low-privileged (non-administrator) macOS user on a host where Admin By Request (ABR) is installed and its privileged daemon is running - which is the product's default operational state. The attacker must additionally be able to: (1) determine the PIN derivation algorithm well enough to produce a valid PIN, indicating the derivation is either observable, deterministic, or insufficiently random; and (2) present an XPC message that ABR's handler accepts as originating from an Apple-signed process, indicating the process identity check is bypassable without holding a legitimate Apple Developer signing credential. No network access is required; the attack is entirely local. Exploitation is bounded by the requirement for any local user account on an ABR-managed macOS host - no non-default configuration or additional feature enablement is needed beyond the product's standard installation. |
| Impact | The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a locally exploitable, low-complexity attack requiring only a standard user account - a realistic baseline in any enterprise macOS fleet. The scope change (S:C) is the most consequential aspect: escalating to macOS administrator yields unrestricted access to all user data, system configuration, and installed software on the endpoint. No EPSS score was available in the input data, so exploitation probability cannot be quantified. No CISA KEV listing exists at time of analysis, meaning confirmed active in-the-wild exploitation is not recorded; the risk is credible but unconfirmed. No POC has been identified in available data. The product's role as a PAM solution amplifies the strategic impact: ABR is deployed specifically to govern privilege escalation, so a bypass undermines the entire security control the product provides. Organizations relying on ABR as their primary macOS privilege boundary should treat this as a high-priority remediation item regardless of EPSS, given the low attack complexity and the direct circumvention of the product's security guarantee. |
| Exploit ScenarioDerived | A standard macOS user with a local shell session reverse-engineers or predicts the PIN derivation algorithm used by ABR, then crafts an XPC message that presents a spoofed Apple-signed process identity to ABR's privileged daemon. ABR validates the spoofed code signature and accepts the attacker-supplied PIN, escalating the user session to full administrator without any interaction from a legitimate admin or end-user. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Privilege escalation in Admin By Request (ABR) for macOS allows a low-privileged local user to obtain full administrator rights by exploiting a predictable PIN derivation mechanism via Apple's Cross-Process Communication (XPC) framework. The attacker masquerades as an Apple-signed process during XPC communication, bypassing ABR's authentication logic entirely. Covered by a vendor security advisory and a CSA alert, the flaw carries a CVSS 8.8 with a scope change; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the fix detailed in the vendor security advisory at https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm - no exact patched version number was present in the input data, so the advisory must be consulted directly to confirm the target upgrade version. The CSA alert at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-110/ should also be reviewed for any supplementary guidance. If immediate patching is not possible, restrict which local user accounts are permitted to invoke ABR's privilege elevation workflow, reducing the pool of users who could attempt exploitation. Additionally, deploy endpoint detection rules to flag anomalous XPC communication patterns targeting ABR's privileged helper process. Note that restricting ABR invocation may interrupt legitimate administrative workflows that depend on the product's elevation functionality, so scope restrictions carefully against operational requirements.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Admin By Request (ABR) is a Privileged Access Management (PAM) solution for macOS that controls and audits elevation of privileges to administrator. Its privilege request flow relies on a PIN to authenticate elevation decisions. The vulnerability stems from an insecure PIN derivation mechanism - the PIN is either deterministically derivable or uses insufficiently random inputs, allowing a low-privileged user to predict or reproduce it. The attack leverages XPC (Cross-Process Communication), Apple's native inter-process communication framework used to mediate communication between unprivileged processes and privileged daemons. By crafting an XPC message that impersonates an Apple-signed process - exploiting weak or absent code-signing validation in ABR's XPC handler - the attacker convinces ABR's privileged component to accept the derived PIN and grant administrative access. The CWE field is listed as N/A; the root cause class most closely aligns with CWE-330 (Use of Insufficiently Random Values) for the PIN derivation and CWE-290 (Authentication Bypass by Spoofing) for the process identity masquerade, though neither is formally confirmed. CPE cpe:2.3:a:admin_by_request_(abr):admin_by_request_(abr):*:*:*:*:*:*:*:* implies all tracked versions may be affected.
Know when Admin By Request Abr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local attack requiring a low-privileged session; deterministic PIN derivation and XPC identity spoofing yield full administrator scope change with complete C/I/A impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
DescriptionCVE.org
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
Executive ViewAI
Admin By Request for macOS contains a privilege escalation vulnerability (CVE-2026-78236, CVSS 8.8) that allows any local user to completely bypass access controls and gain full administrator rights, directly undermining the security controls your organization relies on. Every macOS endpoint running ABR is vulnerable to unauthorized privilege elevation by local attackers, exposing sensitive data and critical systems to compromise. Leadership must immediately assess deployment scope and implement protective measures pending patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict local user logon capabilities on systems running ABR, disable ABR on non-critical endpoints pending patch release, implement detection alerting for privilege escalation attempts and XPC process masquerading by non-Apple binaries, and evaluate replacement with alternative privileged access management solutions. Monitor vendor advisories closely for patch release timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB