Privilege Escalation in Sophos Endpoint for macOS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Sophos Limited

Description

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-18367

Affected Vendors & Products

Vendor	Product	Version / Range
sophos	endpoint	to 2026.1.1 (exc)
sophos	home	to 10.11.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in Sophos Endpoint and Sophos Home for macOS. It allows local users to gain root access and execute arbitrary code on affected systems older than specific versions (2026.1.1 for Endpoint and 10.11.6 for Home).

Impact Analysis

If you use an outdated version of Sophos Endpoint or Sophos Home on macOS, an attacker with local access could escalate privileges to root and take full control of your system. This could lead to data theft, malware installation, or system compromise.

Mitigation Strategies

Update Sophos Endpoint for macOS to version 2026.1.1 or later and Sophos Home for macOS to version 10.11.6 or later to address the privilege escalation vulnerability.

Hi! I’m here to help you understand CVE-2026-18367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70