CVE-2026-78236

HighCVSS 8.8

Published: 26/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

Risk Assessment

Risk of privilege escalation to administrator by a low-privileged user, potentially leading to full system control.

Recommendation

Apply the vendor patch that strengthens the PIN derivation mechanism in ABR and prevents masquerading as Apple-signed processes.

Other vulnerabilities in ABR

CVE-2026-78237High
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

Original NVD description (English source)