CVE-2026-78237

Deferred Deferred - Pending Action

Privilege Escalation via Sudoers File Injection in ABR

Publication date: 2026-08-26

Last updated on: 2026-09-03

Assigner: CSA

Description

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-03

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-78237

EUVD

EUVD-2026-66332

Affected Vendors & Products

Vendor	Product	Version / Range
admin_by_request	admin_by_request	to 5.2.2 (exc)
admin_by_request	admin_by_request	From 5.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

CVE-2026-78237 is a local privilege escalation vulnerability in the Admin By Request macOS client. It allows a low-privileged user to inject malicious entries into the sudoers file due to insufficient input validation. This results in persistent root access even after the ABR session ends.

Detection Guidance

Check Admin By Request version on macOS with: defaults read /Library/Preferences/com.adminbyrequest.plist version. If version is below 5.3, the system is vulnerable.

Impact Analysis

An attacker with local access could exploit this to gain persistent root privileges on your system. This could lead to full control over the affected machine, allowing installation of malware, data theft, or disruption of services.

Compliance Impact

This vulnerability allows low-privileged users to gain persistent root access by injecting malicious entries into the sudoers file, which could lead to unauthorized system modifications and data breaches. Such unauthorized access may violate compliance requirements under GDPR and HIPAA, as it undermines data protection and access control measures.

Mitigation Strategies

Update Admin By Request to version 5.3 or later immediately. Verify sudoers file integrity for unauthorized entries. Restrict local access to endpoints until patched.

Hi! I’m here to help you understand CVE-2026-78237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70