Reported by 1 outlet
macOS EDR Bypass via Legitimate OS Behavior — Standard User Account Can Silently Unload CrowdStrike Falcon, Permanently Deactivate Kandji MDM
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
macOS EDR Bypass via Legitimate OS Behavior — Standard User Account Can Silently Unload CrowdStrike Falcon, Permanently Deactivate Kandji MDM
securityweek.com · 111d ago · June 25th, 2026
XM Cyber demonstrated a macOS attack technique requiring only a standard (non-admin) user account to silently disable enterprise endpoint security tools by chaining legitimate macOS behaviors rather than exploiting software vulnerabilities. The attack chain exploits the persistence of the kernel's code-signing trust cache after a legitimately signed application executes, injecting malicious payloads into application Interface Builder (NIB) files to invoke privileged XPC methods.
Successfully demonstrated against:
-
CrowdStrike Falcon Sensor — fully unloaded from standard user account. CrowdStrike fixed the issue, paid a bounty, and added detection/prevention on all sensor versions.
-
Kandji MDM — permanently deactivated via two-stage chain (CVE-2026-39118 assigned).
-
Third unnamed EDR vendor — confirmed vulnerable, patch in progress.
Researcher Hillel Pinto will release XPC Hunter, an open-source tool automating XPC privilege escalation surface discovery, at Black Hat US 2026.
-