EUVD-2026-66332Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local-only attack during an active ABR session (AC:H); low-privilege account required (PR:L); scope changes to host OS via persistent sudoers entry (S:C).
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.
AnalysisAI
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have a standard (low-privileged) local user account on a macOS system with Admin By Request installed and running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 with vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects the attack's local-only reach, elevated complexity (requires an active ABR session and a specific input injection path), and transformative impact: persistent root on the host after session termination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A standard macOS user on a corporate endpoint initiates a legitimate ABR privilege elevation request and, during the session input phase, supplies a crafted string that ABR writes without sanitization into the sudoers file - for example, appending a rule granting themselves NOPASSWD root for all commands. After the ABR session expires and the temporary elevation is revoked, the injected sudoers entry remains intact, giving the user persistent, unrestricted root access via sudo without further interaction. … |
| Remediation | Consult the vendor security advisory at https://docs.adminbyrequest.com/security-advisories/abr-mac-26-02.htm for the patched ABR macOS agent version and apply it immediately; the input data does not specify an exact fixed version number, so the advisory is the authoritative source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all macOS systems with ABR installed and identify systems with untrusted users or shared access; escalate findings to macOS fleet administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Admin By Request Abr
View allSame weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today