EUVD-2026-16160Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to system with low privilege account
-
ExploitConnect to VSL XPC service without validation
-
ExecutionCall unvalidated writeReceiptFile function
-
ImpactWrite arbitrary files with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated local user access to the target macOS system running VSL with the privileged helper service active. Any local process can exploit the unvalidated NSXPC connection to call writeReceiptFile and runUninstaller functions without additional authorization checks. |
| Impact | Real-world risk is moderate despite the high CVSS score of 8.8. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H appears to contain an error, as the vulnerability description and SSVC classification clearly indicate local exploitation requiring local code execution capability, not network-based access. SSVC analysis confirms proof-of-concept code exists, the vulnerability is not automatable (requiring local access), and achieves total technical impact (privilege escalation to root). The EPSS score of 0.02% (4th percentile) indicates extremely low observed exploitation activity in real-world environments. This is not a CISA KEV entry, suggesting no confirmed active exploitation campaigns. Priority should be moderate: the vulnerability provides complete system compromise but requires existing local access to the target macOS system, limiting its utility to post-compromise scenarios or insider threats. |
| Exploit ScenarioDerived | A local attacker with standard user privileges on a macOS system running Vienna Assistant 1.2.542 writes a malicious application that connects to the VSL privileged helper's XPC endpoint without authentication. The attacker invokes the writeReceiptFile function to plant a malicious launch daemon plist in /Library/LaunchDaemons, then calls runUninstaller to execute an attacker-controlled binary with root privileges, achieving full system compromise. Publicly available exploit code exists per SSVC analysis, lowering the technical barrier for exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Vienna Assistant 1.2.542 on macOS allows local privilege escalation through an unauthenticated XPC service endpoint that accepts connections from any process. The vulnerable VSL privileged helper service exposes functions to write arbitrary files to any location and execute arbitrary binaries with any arguments, enabling a low-privileged local user to gain root access. A proof-of-concept exploit exists per SSVC assessment, with an EPSS score of 0.02% indicating low observed exploitation probability in the wild.
RemediationAI
Users should monitor the SEC Consult advisory at https://r.sec-consult.com/vsl for vendor patch releases addressing this XPC validation issue. Until a patched version is available, mitigate risk by restricting local user access to systems running Vienna Assistant 1.2.542, removing the application from multi-user or untrusted environments, and implementing endpoint detection rules monitoring for unauthorized XPC connections to the VSL helper service. Organizations should audit systems for Vienna Assistant installations and consider temporary removal if the software is not business-critical. The underlying fix requires implementing proper XPC client validation in shouldAcceptNewConnection using code signing or entitlement checks, and adding per-function authorization in writeReceiptFile and runUninstaller methods.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exploits macOS's NSXPC inter-process communication framework, specifically the shouldAcceptNewConnection delegate method used to validate XPC client connections. CWE-306 (Missing Authentication for Critical Function) occurs because the VSL privileged helper tool's XPC listener does not implement any client validation logic, allowing arbitrary processes to bind to the service and invoke privileged operations. The HelperToolProtocol exposes writeReceiptFile and runUninstaller functions that execute with elevated privileges inherited from the helper tool without performing authorization checks on the calling process, violating Apple's secure XPC service design guidelines. Vienna Assistant 1.2.542 is confirmed affected per EUVD-2026-16160 reporting.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate clients at all. This means that any process can connect to this service using the configured protocol. A malicious process is able to call all the functions defined in the corresponding HelperToolProtocol. No validation is performed in the functions "writeReceiptFile" and “runUninstaller” of the HelperToolProtocol. This allows an attacker to write files to any location with any data as well as execute any file with any arguments. Any process can call these functions because of the missing XPC client validation described before. The abuse of the missing endpoint validation leads to privilege escalation.
Executive ViewAI
Vienna Assistant 1.2.542 on macOS contains a local privilege escalation vulnerability in its privileged helper service that allows any local user to gain root-level access without authentication. Organizations deploying this software face risk of complete system compromise by any user account with local access, including contractors, support staff, or compromised standard user accounts.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or uninstall Vienna Assistant 1.2.542 if not operationally required; (2) Restrict local user account creation and access on affected macOS systems through MDM or configuration management; (3) Implement application allowlisting to prevent execution of Vienna Assistant; (4) Monitor for XPC service invocations and unexpected file writes to system directories; (5) Enforce user access controls and limit local administrative privileges where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB