Admin By Request Abr
Monthly
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.
Privilege escalation in Admin By Request (ABR) for macOS allows a low-privileged local user to obtain full administrator rights by exploiting a predictable PIN derivation mechanism via Apple's Cross-Process Communication (XPC) framework. The attacker masquerades as an Apple-signed process during XPC communication, bypassing ABR's authentication logic entirely. Covered by a vendor security advisory and a CSA alert, the flaw carries a CVSS 8.8 with a scope change; no public exploit or CISA KEV listing has been identified at time of analysis.
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.
Privilege escalation in Admin By Request (ABR) for macOS allows a low-privileged local user to obtain full administrator rights by exploiting a predictable PIN derivation mechanism via Apple's Cross-Process Communication (XPC) framework. The attacker masquerades as an Apple-signed process during XPC communication, bypassing ABR's authentication logic entirely. Covered by a vendor security advisory and a CSA alert, the flaw carries a CVSS 8.8 with a scope change; no public exploit or CISA KEV listing has been identified at time of analysis.