CVE Alert: CVE-2026-11318 – Zuler Technology

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.

**Risk verdict:** This is a high-impact local escalation risk; urgency cannot be confirmed as active exploitation because KEV, SSVC and EPSS status are not supplied.

**Why this matters:** A foothold for any low-privilege local user could become complete control of that macOS host, enabling data theft, tampering, disruption and persistence. A public exploit reference is listed, but whether a working PoC is available is unclear; confirm before calibrating exposure.

**Most likely attack path:** An attacker needs local access and low privileges, but the path has low complexity and requires no further user action. They invoke the privileged service to gain root; the stated scope is unchanged, though stolen credentials or sessions could support movement to other systems.

**Who is most exposed:** Prioritise managed Macs with the application installed, especially shared endpoints and devices accessible to less-trusted users. Remote-support deployments may hold sensitive sessions or credentials.

Review service and process telemetry for unexpected installer activity or root-owned child processes.

Correlate XPC connections to the installer service with the initiating user and process.

Check for unfamiliar privileged launch items, binaries or recent system changes.

Hunt endpoint logs for suspicious package installation followed by credential access.

Mitigation and prioritisation:

Identify and deploy the vendor-confirmed fixed release; do not infer a safe version from the supplied data.

Until patched, remove or disable the application/service where operationally safe.

Restrict local access and monitor affected Macs; validate service behaviour after changes.

If KEV is confirmed or EPSS is at least 0.5, treat as priority 1; confirm both statuses and PoC availability promptly.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.