Back www.iru.com

Agent 4 7 5 5374

www.iru.com • June 24, 2026

CVE-2026-39118 — An access control issue existed in the Kandji Agent (macOS). A local attacker with standard user privileges could invoke restricted functionality. This issue was addressed with improved validation.

Affected: Kandji Agent (macOS) before 4.7.5 (5374)

Fixed in: 4.7.5 (5374), available March 25, 2026 (this version)

Severity: CVSS 3.1 — 6.1 (Medium) · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Credit: Iru thanks Hillel Pinto of XM Cyber for reporting this issue.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New macOS Flaw Allows Users to Disable Security Tools Without Admin Rights Researchers at XM Cyber have identified a macOS vulnerability that enables standard user accounts to disable enterprise security tools without requiring administrator credentials. This technique exploits the way macOS validates application trust, allowing attackers to impersonate trusted components and invoke privileged functions. The flaw affects major security products, including CrowdStrike Falcon and Kandji MDM, and does not require kernel exploits or trigger alerts. XM Cyber's tool, XPC Hunter, will be presented at Black Hat USA in August 2026 to help identify similar vulnerabilities. Kandji has patched the issue and assigned CVE-2026-39118, published on June 15, 2026. The vulnerability poses a significant risk to organizations relying on macOS for security. Apple has yet to respond or publish an advisory regarding this issue. 12 sources 71

Extracted Entities

Agent 4 7 5 5374

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)