Researchers showed that a normal non-admin macOS user can silently turn off some enterprise security tools, including endpoint detection and response (EDR) and mobile device management (MDM) agents. XM Cyber said the attack chains weakly validated XPC service connections, malicious changes to Interface Builder NIB files, and persistence in macOS's code-signing trust cache after a signed app runs; it demonstrated the technique against CrowdStrike Falcon Sensor and Kandji, and Kandji assigned CVE-2026-39118 and patched its product.
Why it matters: Organizations using macOS fleets could lose key security monitoring and management controls without obvious alerts, even from a standard user account. Defenders should review Kandji fixes, validate CrowdStrike detections, and assess exposed XPC privilege paths on managed Macs now.
Eduard Kovacs
2026.06.24
100% relevant
This article appears to be the first tracked report establishing the specific macOS attack chain, its impact on CrowdStrike Falcon and Kandji, and Kandji's assignment of CVE-2026-39118.
← Back to all stories