Omnissa Workspace ONE Assist EUVD-2026-35705

Attacker must already have an interactive local session on a macOS endpoint with the Omnissa Workspace ONE Assist agent installed and running, holding low-privilege (standard user) credentials per CVSS PR:L - no user interaction (UI:N) and no admin rights are required beyond that initial foothold. Exploitation is limited to macOS builds of Workspace ONE Assist (Windows/Linux/mobile agents are not in scope of this CVE), and requires the vulnerable agent version to be present and active; environments that do not deploy Workspace ONE Assist on macOS, or that have already upgraded per OMSA-2026-0001, are not exposed. The AV:L vector means this is not directly exploitable over the network - it is a post-compromise / insider-threat primitive useful for escalating from initial access to root.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with a classic local EoP: the attacker must already be on the box with low-privilege credentials, but once there the attack is low-complexity, needs no user interaction, and yields full compromise of the host. EPSS, KEV status, and SSVC decision data were not provided in the input, and the only public references are vendor advisory pages (no NVD analysis text, no third-party POC), so real-world exploitation prevalence cannot be quantified from this dataset - treat the absence of EPSS/KEV as 'unknown', not 'low'. Relative priority should be high for fleets that run Workspace ONE Assist on macOS endpoints used by untrusted or shared users (kiosks, contractor laptops, lab Macs), and moderate for single-user developer laptops where the local-access prerequisite is harder to satisfy by an external attacker; chaining with a browser or phishing-based initial access would make this a practical post-exploitation lateral/privilege step.

An attacker who has obtained a standard (non-admin) macOS account on a managed endpoint - for example via phishing, a malicious download, or a compromised contractor credential - invokes the Workspace ONE Assist helper with a crafted pathname containing traversal sequences, causing the privileged helper to read, overwrite, or execute a file outside its intended directory (such as a LaunchDaemon plist or a binary in a root-owned location). The result is code execution as root, giving the attacker full control of the Mac, persistence, and the ability to pivot into other Workspace ONE-managed assets. No public exploit was identified at time of analysis, but the CWE-22 root cause and AC:L rating suggest a working exploit would be straightforward to develop.