What’s Vulnerable › Vulnerabilities

CVE-2026-78236: Insecure PIN derivation mechanism in Admin By Request (ABR)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-26 · updated 2026-09-03
• Weakness: CWE-284

Description

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

Affected products

• Admin By Request (ABR): through 5.2.2

References

• https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-110/

Get alerted when CVE-2026-78236 or the next vulnerability affects your stack