CVE-2026-78236
HIGH
8,8
Source: 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
284
Improper Access Control
IncompleteCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Varies By Context
Applicable Platforms
Technologies:
Not Technology-Specific, ICS/OT, Web Based
285
Improper Authorization
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Potential Impacts:
Read Application Data
Read Files Or Directories
Modify Application Data
Modify Files Or Directories
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
Not Technology-Specific, Web Server, Database Server
287
Improper Authentication
DraftCommon Consequences
Security Scopes Affected:
Integrity
Confidentiality
Availability
Access Control
Potential Impacts:
Read Application Data
Gain Privileges Or Assume Identity
Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies:
Not Technology-Specific, Web Based, ICS/OT
327
Use of a Broken or Risky Cryptographic Algorithm
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Accountability
Non-Repudiation
Potential Impacts:
Read Application Data
Modify Application Data
Hide Activities
Applicable Platforms
Languages:
Not Language-Specific, Verilog, VHDL
Technologies:
Not Technology-Specific, ICS/OT
https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-110/