CVE-2026-18367

CriticalCVSS 9.3

Published: 06/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Summary

A privilege escalation vulnerability in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows local users to execute arbitrary code as root.

Risk Assessment

A local user can gain full control over the system, leading to complete compromise of data confidentiality, integrity, and availability.

Recommendation

Update Sophos Endpoint to version 2026.1.1 or later and Sophos Home to version 10.11.6 or later. Restrict local access to systems.

Original NVD description (English source)

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.