CVE-2026-78236: Insecure PIN derivation mechanism in Admin By Request (ABR)
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the affected product to the latest version promptly to address the insecure PIN derivation mechanism in Admin By Request (ABR).
Event History
Frequently Asked Questions
Does exploitation require remote network access or user interaction?
No. The attack vector is local and does not require user interaction.
What level of access must an attacker already have?
The attacker must already have low-privileged local access. Successful exploitation can then result in administrator-level privileges.
What is the potential impact beyond the initially compromised user account?
The vulnerability has high confidentiality, integrity, and availability impact, and its scope is changed. This indicates the compromise can affect resources outside the attacker's initial security authority.