CVE-2026-78236

Deferred Deferred - Pending Action

Privilege Escalation in ABR via XPC Spoofing

Publication date: 2026-08-26

Last updated on: 2026-09-03

Assigner: CSA

Description

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-03

Generated

2026-09-17

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-15

NVD

CVE-2026-78236

EUVD

EUVD-2026-66331

Affected Vendors & Products

Vendor	Product	Version / Range
admin_by_request	admin_by_request	to 5.2.2 (inc)
admin_by_request	admin_by_request	From 5.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2026-78236 is a high-severity vulnerability in the Admin By Request (ABR) privileged access management application for macOS. It involves an insecure PIN derivation mechanism that allows a low-privileged user to escalate privileges to administrator level by exploiting Cross-Process Communication (XPC) while impersonating an Apple-signed process.

Detection Guidance

To detect CVE-2026-78236, check if your Admin By Request (ABR) macOS client version is below 5.3. Use the command 'defaults read /Library/Preferences/com.adminbyrequest.plist CFBundleShortVersionString' to verify the installed version. If the output is 5.2.2 or lower, the system is vulnerable.

Impact Analysis

This vulnerability allows an attacker with local access to gain unauthorized elevated privileges, potentially compromising the entire system. It could lead to unauthorized administrative access, data theft, or system manipulation if exploited.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by enabling unauthorized privilege escalation. GDPR mandates strict access controls and protection of personal data, while HIPAA requires safeguards to prevent unauthorized access to sensitive health information. The flaw allows low-privileged users to gain administrator privileges, risking unauthorized data access or modification.

Mitigation Strategies

Update Admin By Request to version 5.3 or later on macOS systems to address the insecure PIN derivation mechanism and XPC-based privilege escalation.
Ensure the latest version is installed by checking the application version and applying vendor patches immediately.

Hi! I’m here to help you understand CVE-2026-78236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70