Loading vulnerability…
Local privilege escalation in Kandji Agent XPC client validation
CVE-2026-39118 is a local privilege-escalation vulnerability in Iru, Inc. Kandji Agent versions before 4.7.5 (build 5374). Insufficient XPC client validation allows an unprivileged macOS user to impersonate the trusted Kandji Menu application and invoke restricted functionality in the privileged agent. The demonstrated exploit combines cached code-signing trust with malicious Interface Builder resource injection and a two-phase XPC chain. Successful exploitation can permanently deactivate the Kandji agent by clearing EDR guards and terminating its Endpoint Security Framework extension.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A standard local user can cross the agent's privilege boundary without administrator credentials or a kernel exploit. Demonstrated effects include permanent Kandji agent deactivation, removal of EDR guards, termination of the Endpoint Security Framework extension, and loss of associated endpoint telemetry. This undermines device-management enforcement and security monitoring on the affected Mac. Arbitrary root code execution or direct access to sensitive data is not specifically established for the Kandji vulnerability.
If you can’t patch tonight, do this now.
Restrict unprivileged modification of application resources to prevent the demonstrated NIB-injection stage. For XPC implementations, validate caller identity during the connection handshake using audit tokens, strict Team ID and application-identity checks, and appropriate entitlements rather than relying on cached code-signing trust or paths alone. Hardened Runtime and Library Validation may block the injection stage in some configurations. Monitor agent heartbeat loss, service-state changes, unusual XPC clients, and unexpected Interface Builder resource modifications; monitoring detects suspicious activity but does not replace the agent update.
Patch, then assume compromise.
Upgrade Kandji Agent to version 4.7.5 (build 5374) or later, which fixes the client-validation vulnerability.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.