What is the CVSS score of EUVD-2026-66331?

EUVD-2026-66331 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Admin By Request are affected by EUVD-2026-66331?

Admin By Request for macOS contains a privilege escalation vulnerability (CVE-2026-78236, CVSS 8.8) that allows any local user to completely bypass access controls and gain full administrator rights,…

How to fix or mitigate EUVD-2026-66331?

Within 24 hours, inventory all macOS systems running Admin By Request and quantify business impact if ABR access controls are circumvented. Within 7 days, implement compensating controls: restrict non-administrative local user access on vulnerable systems, deploy detection rules for XPC-based process masquerading attempts, and disable ABR on non-critical systems if operationally feasible. Within 30 days, evaluate alternative endpoint privilege management solutions, establish a patch-readiness plan with the vendor, and implement enhanced monitoring for privilege escalation indicators across your macOS fleet.

Admin By Request EUVD-2026-66331

| CVE-2026-78236 HIGH

Improper Authentication (CWE-287)

2026-08-26 CSA

Apple Admin By Request Abr Authentication Bypass

8.8

CVSS 3.1 · Vendor: CSA

Severity by source

Vendor (CSA) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local attack requiring a low-privileged session; deterministic PIN derivation and XPC identity spoofing yield full administrator scope change with complete C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CSA).

CVSS VectorVendor: CSA

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 26, 2026 - 08:01 vuln.today

CVE Published

Aug 26, 2026 - 07:20 cve.org

HIGH 8.8

DescriptionCVE.org

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

AnalysisAI

Privilege escalation in Admin By Request (ABR) for macOS allows a low-privileged local user to obtain full administrator rights by exploiting a predictable PIN derivation mechanism via Apple's Cross-Process Communication (XPC) framework. The attacker masquerades as an Apple-signed process during XPC communication, bypassing ABR's authentication logic entirely. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain local low-privileged macOS user session

Delivery

Analyze and predict insecure PIN derivation logic

Exploit

Forge Apple-signed process identity for XPC

Execution

Send crafted XPC message to ABR privileged daemon

Persist

ABR accepts spoofed identity and derived PIN

Impact

Full administrator privileges granted

Access

Obtain local low-privileged macOS user session

Delivery

Analyze and predict insecure PIN derivation logic

Exploit

Forge Apple-signed process identity for XPC

Execution

Send crafted XPC message to ABR privileged daemon

Persist

ABR accepts spoofed identity and derived PIN

Impact

Full administrator privileges granted

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local, authenticated session as a low-privileged (non-administrator) macOS user on a host where Admin By Request (ABR) is installed and its privileged daemon is running - which is the product's default operational state. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a locally exploitable, low-complexity attack requiring only a standard user account - a realistic baseline in any enterprise macOS fleet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A standard macOS user with a local shell session reverse-engineers or predicts the PIN derivation algorithm used by ABR, then crafts an XPC message that presents a spoofed Apple-signed process identity to ABR's privileged daemon. ABR validates the spoofed code signature and accepts the attacker-supplied PIN, escalating the user session to full administrator without any interaction from a legitimate admin or end-user. …
Remediation	Apply the fix detailed in the vendor security advisory at https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm - no exact patched version number was present in the input data, so the advisory must be consulted directly to confirm the target upgrade version. … Detailed patch versions, workarounds, and compensating controls in full report.