PT-2026-81975

CVE-2026-78236

·

Published

2026-08-26

·

Updated

2026-08-26

Description by

CVSS 3.1
8.8
High
MetricsAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-284: Improper Access Control
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-285: Improper Authorization
CWE-287: Improper Authentication
Related identifiers
CVE-2026-78236
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com