[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f79AOpx_BDHCESDeB9oq4nmXZk43sH5KLCHsfYet10Fw":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"f74701fd-8352-4131-9954-b345fdaa1485","macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools","macos-flaw-allowed-standard-users-to-disable-crowdstrike-and-kandji-security-too-f960ab","A macOS XPC flaw let regular users disable CrowdStrike and Kandji tools, exposing security gaps that vendors patched after XM Cyber reported the security issue.","XM Cyber discovered a macOS vulnerability in the XPC inter-process communication architecture that allowed unprivileged users to disable enterprise security tools including CrowdStrike Falcon Sensor and Kandji MDM Agent. The flaw exploited CDHash cache and NIB injection techniques to hijack trusted applications and manipulate endpoint detection and response (EDR) capabilities. Both vendors patched the vulnerability after responsible disclosure, with XM Cyber releasing an open-source detection tool called XPC Hunter.","macOS XPC flaw enabled standard users to disable CrowdStrike and Kandji security tools.","https:\u002F\u002Fhackread.com\u002Fmacos-flaw-users-disable-crowdstrike-kandji-security-tools\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fmacos-flaw-users-disable-crowdstrike-kandji-security-tools.png","2026-06-26T12:43:05+00:00","2026-06-26T14:00:28.085048+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"XM Cyber","vendor",{"name":21,"type":19},"CrowdStrike",{"name":23,"type":19},"Kandji",{"name":25,"type":19},"Apple",{"name":27,"type":28},"CrowdStrike Falcon Sensor","product",{"name":30,"type":28},"Kandji MDM Agent","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53],{"type":54,"value":55,"context":56},"cve","CVE-2026-39118","Kandji MDM Agent privilege escalation vulnerability via XPC chain",[21,25,18],{"controls":59,"vendors":138},[60,88,109],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,72,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":61,"product_name":69,"url":70,"description":71},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[93,101],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[139,144],{"slug":140,"name":25,"logo_path":141,"roles":142},"apple","\u002Fvendor-logos\u002Fapple.png",[143],"affected",{"slug":145,"name":21,"logo_path":146,"roles":147},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[143],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":165},"macos-xpc-flaw-let-unprivileged-users-disable-edr-and-mdm-security-tools","macOS XPC Flaw Let Unprivileged Users Disable EDR and MDM Security Tools","A vulnerability in macOS's XPC inter-process communication architecture allowed standard, unprivileged users to disable enterprise security tools like CrowdStrike Falcon and Kandji MDM by exploiting CDHash caching and NIB injection to hijack trusted processes. This is particularly dangerous because the very tools designed to detect and prevent attacks were themselves the attack surface, effectively blinding defenders to subsequent malicious activity. The flaw highlights that security software running on a general-purpose OS inherits all of that OS's underlying vulnerabilities, and assumes a level of OS integrity that may not always hold. Responsible disclosure and prompt patching by both vendors prevented widespread exploitation, but the window between discovery and patch deployment represents a critical period of organizational risk.",[153,154,155,156,157,158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 8: Audit Log Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF PR.IP-12: Vulnerability Management Plan","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1548: Abuse Elevation Control Mechanism",{}]