CVE-2026-18367 in Endpoint for macOS
Summary
by MITRE • 08/07/2026
A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This privilege escalation vulnerability represents a critical security flaw in Sophos endpoint protection software for macOS systems, specifically affecting versions prior to 2026.1.1 for Sophos Endpoint and 10.11.6 for Sophos Home. The vulnerability enables local attackers to escalate their privileges from standard user level to root access, thereby gaining complete control over affected systems. This type of flaw falls under the category of privilege escalation vulnerabilities as defined by CWE-264, which encompasses issues where software allows users to gain higher privileges than they should be granted. The attack vector is particularly concerning because it requires only local system access, making it accessible to anyone with physical or remote access to a vulnerable machine.
The technical implementation of this vulnerability likely involves improper privilege handling within the Sophos software components that operate at system level. When Sophos Endpoint or Sophos Home executes certain functions on macOS, it may not properly validate user permissions or may inadvertently create executable code paths that can be manipulated by local users. This could manifest through insecure file permissions, improper sandboxing mechanisms, or flawed privilege separation between different software modules. The vulnerability allows attackers to execute arbitrary code with root privileges, which represents a severe compromise of system integrity and security controls.
From an operational perspective, this vulnerability poses significant risk to organizations relying on Sophos endpoint protection solutions. Attackers who gain local access to systems running vulnerable versions can immediately escalate their privileges without requiring additional exploitation techniques or external attack vectors. This makes the vulnerability particularly dangerous in environments where multiple users have access to workstations, as any compromised user account could potentially be leveraged to achieve complete system compromise. The impact extends beyond individual machine security to potentially enable lateral movement within networks and persistence mechanisms that could remain undetected for extended periods.
Organizations should prioritize immediate remediation by upgrading to Sophos Endpoint version 2026.1.1 or later, and Sophos Home version 10.11.6 or later, as these versions contain the necessary patches addressing this privilege escalation flaw. System administrators should conduct comprehensive inventory checks to identify all affected systems and implement a coordinated patching strategy across the enterprise environment. Additional mitigations include implementing strict access controls, monitoring for suspicious privilege escalation attempts, and maintaining up-to-date threat intelligence regarding similar vulnerabilities in endpoint protection software. This vulnerability aligns with ATT&CK technique T1068 which covers 'Exploitation for Privilege Escalation' and demonstrates how endpoint security solutions can themselves become attack vectors when not properly secured against local privilege escalation attacks.