Researchers have uncovered a novel macOS privilege-escalation technique that allows a user with standard privileges to disable enterprise security tools and invoke privileged functions without administrator credentials.
The technique exploits how macOS establishes and validates application trust information. It enables an attacker to impersonate trusted application components and silently perform actions that should only be available to privileged processes.
Disabling EDR and MDM
Researchers at XM Cyber who developed the technique showed how an attacker could use it to disable CrowdStrike Falcon Endpoint Detection and Response (EDR) and Kandji Mobile Device Management (MDM) without needing any administrator credentials or kernel exploits and without triggering any alert.
According to XM Cyber, the issue potentially affects other macOS applications that provide privileged Cross-Process Communication (XPC) services and rely on Apple’s CDHash, a cryptographic identifier for verifying an application’s authenticity. “MacOS applications routinely expose privileged XPC services running as root — yet the trust boundaries protecting these interfaces are fundamentally flawed,” said XM Cyber senior security researcher Hillel Pinto, in a report this week.
XM Cyber has developed an open source large language model (LLM)-powered tool it named XPC Hunter to help security researchers look for exploitable macOS XPC privilege escalation vulnerabilities across other macOS applications. The company plans to release XPC Hunter at Black Hat USA in August.
MacOS XPC services allow different applications or processes to talk to each other in a secure manner. Security tools, MDM agents, system utilities, and many other macOS apps use XPC services to request privileged operations from background root processes for tasks such as installing system extensions, accessing kernel-level telemetry, or unloading security components.
Dark Reading contacted Apple but received no response at press time.
A Problem With Caching, Reusing
The core problem, according to XM Cyber, lies in how macOS caches and reuses an application’s CDHash or the cryptographic fingerprint that the OS uses to verify an application’s authenticity. XM Cyber found that once macOS caches CDHash, the operating system continues to trust the application even if an attacker were to later modify some of its components. This allows a standard user to impersonate legitimate application components and call privileged XPC services that should only be accessible to properly signed vendor code. XM Cyber showed how an attacker could exploit the weakness to inject malicious code into a so-called NIB file inside a trusted application and trick the system into running privileged commands.
XM Cyber used the technique to “completely unload the CrowdStrike Falcon endpoint security sensor” and effectively neutralize all its endpoint detection, network visibility and process monitoring capabilities on a macOS system, Pinto said. The company was able to similarly permanently deactivate Kandji MDM. “Beyond these two specific products, the underlying CDHash cache exploitation + NIB injection technique represents a generic attack primitive applicable to any macOS application that exposes privileged XPC services and includes a user-facing app component with injectable NIBs,” Pinto said.
Iru Inc. has released an updated version of its Kandji Agent software that protects against the exploit on macOS systems after XM Cyber informed the company about the vulnerability (CVE-2026-39118). XM Cyber said it has notified CrowdStrike about the vulnerability as well, though it is not clear if the latter has released a patch for it yet. “Disclosure is ongoing with CrowdStrike’s security team,” Pinto said.
Potentially Large Impact
In comments to Dark Reading, Pinto describes the problem as a flaw in macOS itself that affects applications that rely on the Apple-provided XPC functionality. “If Apple had fixed the underlying issue in macOS, these products would not be vulnerable through this attack vector,” Pinto says. “However, Apple has stated that they do not intend to address the bug,” he claims. “Consequently, affected vendors must implement their own mitigations and hardening measures. Kandji, for example, has done an excellent job addressing the issue.”
Pinto stresses that not all macOS applications are vulnerable. The issue affects applications that implement XPC communication between their components, which, in practice, includes a large portion of the macOS ecosystem. “Developers using XPC should review and strengthen their validation logic to ensure their applications cannot be exploited through the vulnerability,” he says.
XPC Hunter itself is solely a research tool to help security researchers identify, validate, and demonstrate the vulnerability within their own environments and with applications they own or are authorized to test, he points out. “The exploitation capabilities are provided exclusively for proof-of-concept and research purposes,” Pinto notes.
No responses yet