EUVD-2026-56826
GHSA-w87j-8jxj-2rgw
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Requires local high-privilege access to plant symlinks in OneDrive paths; no user interaction needed; full CIA impact within unchanged scope is consistent with arbitrary file read/write.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Microsoft OneDrive for macOS exploits improper symbolic link resolution (CWE-59), enabling a locally authorized high-privileged attacker to redirect OneDrive file operations to unintended filesystem locations and gain elevated access beyond their sanctioned scope. Affected versions span 26.0.0.0 up to but not including 26.095.0519.0003 on macOS exclusively. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog, though the full high-high-high CIA impact within the unchanged scope warrants prompt patching for any enterprise deploying OneDrive on macOS endpoints.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access - Link Following) describes a class of flaw in which a privileged process resolves a symlink or junction point without validating that the target path falls within an authorized boundary. On macOS, OneDrive performs file sync and update operations with elevated filesystem access; when it traverses attacker-controlled directory paths without resolving and sanitizing symlinks first, it can be induced to read from or write to arbitrary locations - including protected system files - outside the directories it is intended to manage. The affected product is confirmed by ENISA EUVD entry EUVD-2026-56826 as Microsoft OneDrive for macOS, covering versions 26.0.0.0 through 26.094.x, with the root cause residing in OneDrive's file-access routines rather than the macOS kernel or a shared library. The vendor-assigned CWE-59 aligns precisely with the described behavior of following an unvalidated link before completing a file operation.
RemediationAI
Vendor-released patch: upgrade Microsoft OneDrive for macOS to version 26.095.0519.0003 or later, as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65680. If immediate patching is operationally constrained, apply the principle of least privilege to macOS accounts - since PR:H is required, ensuring that no non-essential users hold local administrative rights removes the majority of realistic attackers from scope; this control has no impact on normal OneDrive sync functionality. As a secondary detective control, enable macOS Unified Logging or endpoint telemetry to alert on unexpected symlink creation events inside OneDrive-managed directories such as ~/Library/CloudStorage/; this does not prevent exploitation but enables faster detection. Disabling OneDrive sync entirely is an effective but operationally disruptive workaround and should be considered only where patching timelines are extended.
A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to byp
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is
An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To
Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a T
Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL i
<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles s
<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles s
<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles s
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability i
Microsoft OneDrive for Android Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerabilit
Microsoft OneDrive for Android Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerabilit
An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symb
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today