Security researchers have uncovered a new macOS privilege-escalation technique that can allow a standard user to disable enterprise security tools and invoke privileged functions without administrator credentials.
The technique, developed by researchers at XM Cyber, abuses how macOS establishes and validates application trust information. By exploiting weaknesses in macOS's handling of trusted application components, an attacker can impersonate legitimate app components and interact with privileged services that should be available only to trusted vendor code.
In demonstrations, XM Cyber showed how the technique could be used to disable CrowdStrike Falcon EDR and Kandji MDM without administrator credentials, without kernel exploits, and without triggering alerts.
The issue highlights a serious trust-boundary problem in macOS applications that expose privileged XPC services.
What Are macOS XPC Services?
XPC services allow macOS applications and background processes to communicate with each other.
Many security products, MDM agents, and system utilities use XPC because they need a safe way for user-facing applications to request privileged operations from background services running as root.
These privileged operations may include:
- installing system extensions
- unloading security components
- accessing telemetry
- managing device configuration
- applying MDM controls
- interacting with protected system areas
- performing administrative tasks
This architecture is common and often necessary. But it depends on one critical assumption: the privileged XPC service must accurately verify that the requesting application component is trusted.
If that trust validation can be bypassed, the privileged service can become an escalation path.
The Role of CDHash
The technique centers on Apple’s CDHash, a cryptographic identifier used to verify the authenticity of an application.
In theory, CDHash helps macOS confirm that an application or component is legitimate and has not been tampered with.
XM Cyber found that once macOS caches a CDHash, the operating system may continue trusting the application even if some components are later modified.
This creates an opportunity for an attacker with standard user privileges to alter parts of a trusted application and still benefit from the trust macOS previously associated with it.
That trust can then be abused to interact with privileged XPC services.
How the Attack Works
At a high level, the attack involves impersonating trusted application components.
XM Cyber demonstrated that an attacker can inject malicious code into a NIB file inside a trusted macOS application.
NIB files are interface resource files used by macOS applications. If an application includes injectable NIBs and exposes privileged XPC services, the attacker may be able to modify the user-facing component while macOS continues to treat it as trusted.
Once the application is trusted, the malicious component can call privileged XPC functions.
The result is a privilege-escalation path that does not require:
- administrator credentials
- a kernel exploit
- direct tampering with protected kernel components
- obvious malicious execution paths
The attack abuses trust in the application layer.
Impact on EDR and MDM Tools
XM Cyber used the technique to disable CrowdStrike Falcon on macOS.
According to the researchers, they were able to unload the Falcon endpoint security sensor and neutralize its endpoint detection, process monitoring, and network visibility capabilities.
They also demonstrated permanent deactivation of Kandji MDM.
This is significant because EDR and MDM tools are supposed to protect enterprise macOS fleets. If an attacker can disable those tools from a standard user context, they can potentially create a blind spot before performing additional malicious activity.
Security tools often rely on privileged services because they need deep system visibility and control. But that same privileged architecture can become dangerous if trust validation is flawed.
Not Limited to Two Products
XM Cyber emphasized that the issue is not limited to CrowdStrike Falcon or Kandji.
The underlying technique may apply to other macOS applications that:
- expose privileged XPC services
- rely on CDHash-based validation
- include user-facing app components with injectable NIBs
- fail to perform additional robust verification of the caller
In practice, this could affect a large portion of the macOS software ecosystem, especially security tools, device management agents, and enterprise utilities.
Not every macOS application is vulnerable, but any application using XPC for privileged operations should review its validation logic.
Vendor Response
Kandji addressed the issue in an updated version of its agent software after XM Cyber disclosed the vulnerability, which is tracked as CVE-2026-39118.
XM Cyber also notified CrowdStrike. According to the researchers, CrowdStrike quickly fixed the issue, paid a bounty, and added detection and prevention across supported versions of the Falcon macOS sensor.
CrowdStrike said the technique exploits a macOS issue and that protections are now in place for Falcon.
XM Cyber’s position is that the root cause sits in macOS itself, because applications relying on Apple-provided XPC functionality may be exposed. The researchers claim Apple does not intend to address the underlying behavior, meaning affected vendors must implement their own hardening.
Why This Is an Architectural Problem
The key lesson is that privileged XPC services cannot rely on shallow or cached trust checks alone.
A privileged service running as root should not simply assume that a caller is safe because macOS previously trusted an application identity.
Instead, it should enforce strong, layered validation.
That may include:
- verifying code signing at request time
- validating team identifiers
- checking hardened runtime status
- verifying bundle integrity
- validating exact executable paths
- confirming entitlements
- checking caller identity through secure APIs
- limiting exposed privileged functions
- requiring explicit authorization for high-risk operations
- logging sensitive requests
The more powerful the XPC function, the stricter the validation should be.
XPC Hunter: A Tool for Finding Similar Issues
XM Cyber has developed an open source LLM-powered research tool called XPC Hunter.
The tool is designed to help researchers identify and validate exploitable macOS XPC privilege-escalation vulnerabilities across macOS applications.
XM Cyber plans to release XPC Hunter at Black Hat USA in August.
The company described the tool as intended for authorized research, validation, and demonstration inside environments where researchers own or have permission to test the applications.
Its release may help vendors find and fix similar issues, but it may also increase attention on XPC trust boundaries across the macOS ecosystem.
Why Enterprises Should Care
macOS is widely used in enterprise environments, especially among developers, executives, creative teams, security teams, and remote workers.
Many organizations rely on EDR and MDM tools to enforce controls on Mac endpoints.
If attackers can disable those tools without admin credentials, the enterprise loses visibility and control over the endpoint.
That can enable:
- stealthy persistence
- credential theft
- data exfiltration
- bypass of device compliance
- disabling of endpoint monitoring
- evasion of incident response
- lateral movement from developer workstations
- tampering with security configurations
A compromised Mac used by a developer or administrator can become a serious enterprise risk.
Recommendations for Security Vendors
Vendors building macOS applications with privileged XPC services should immediately review their trust validation logic.
Recommended actions include:
- audit all privileged XPC services
- identify which clients are allowed to call privileged functions
- avoid relying only on cached CDHash trust
- validate code signing dynamically
- verify exact caller identity and entitlements
- avoid loading sensitive logic from injectable NIBs
- harden user-facing components
- restrict root-level operations to the smallest possible set
- log and alert on privileged XPC calls
- test for caller impersonation
- perform red-team style testing of XPC boundaries
Security vendors should assume that local attackers may attempt to modify non-protected application components.
Recommendations for Enterprise Defenders
Enterprise security teams should ensure macOS security and MDM agents are fully updated.
Recommended actions include:
- update CrowdStrike Falcon and Kandji agents to fixed versions
- confirm vendor-specific mitigations are enabled
- monitor for unexpected unloading of EDR or MDM components
- alert on changes to security agent application bundles
- detect suspicious modification of NIB files
- monitor privileged XPC service calls where possible
- investigate sudden loss of endpoint telemetry
- prevent standard users from modifying protected application directories
- restrict local write access to security tool components
- verify device compliance through multiple signals
- review macOS logs for unusual service unload activity
If a security agent disappears, stops reporting, or becomes disabled unexpectedly, treat it as a possible compromise indicator.
Why “No Admin Required” Matters
Many endpoint security models assume that standard users have limited ability to disable enterprise controls.
This technique challenges that assumption.
If a standard user context can be used to trigger privileged operations through trusted XPC channels, attackers do not need to steal admin credentials first.
That lowers the barrier for post-compromise activity.
An attacker who compromises a normal user account through phishing, malware, or browser exploitation could potentially disable security protections before escalating further.
That makes this class of vulnerability especially important for enterprise environments.
Final Thoughts
The macOS XPC privilege-escalation technique disclosed by XM Cyber shows how application trust boundaries can fail in subtle but dangerous ways.
By abusing CDHash caching and injectable application components, a standard user may be able to impersonate trusted code and invoke privileged functions without administrator credentials.
The demonstrations against CrowdStrike Falcon and Kandji MDM show the potential impact: disabling the very tools enterprises rely on to secure macOS fleets.
The broader lesson is clear. Privileged XPC services must enforce strong server-side-style validation of every caller and every sensitive action. Cached trust is not enough.
For vendors, this means hardening XPC interfaces. For enterprises, it means updating macOS security agents, monitoring for tool tampering, and treating unexpected loss of endpoint visibility as a high-priority signal.
macOS security depends not only on strong platform controls, but on how applications enforce trust at every privileged boundary.
