Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (ESET) · only source for this CVE.
CVSS VectorVendor: ESET
Lifecycle Timeline
2DescriptionCVE.org
Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.
AnalysisAI
We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects.
Let's extract relevant data:
- CVE ID: CVE-2026-10610
- Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user."
- CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5)
- CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CWE: CWE-269 (Improper Privilege Management)
- EPSS Score: 0.14% (percentile 4%)
- Reported by: ESET
- CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:*
- Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos
- SSVC: Exploitation: none, Automatable: no, Technical Impact: total
- ENISA EUVD ID: EUVD-2026-48558
- Affected versions (EUVD):
- ESET Endpoint Security for macOS 0 ≤8.0.7200.0
- ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0
- ESET Endpoint Security for macOS 8.1 ≤8.1.200.0
- ESET Cyber Security for macOS 0 ≤9.0.5300.0
- ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0
- References:
- [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed
- [vuldb] (advisory) https://vuldb.com/vuln/382896
- [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610
We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software.
Now, we need to produce fields. Let's go through each:
- product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-48558
GHSA-8mrp-j364-wvp5