CVE-2026-11626: CleanWipe Removal Tool Privilege Escalation

CVE-2026-11626 Overview

CVE-2026-11626 is a local privilege escalation vulnerability in the CleanWipe Removal Tool for macOS, affecting versions prior to 16.0.0.65. The flaw allows an attacker with limited privileges on an affected system to elevate to administrative control. The weakness is categorized under [CWE-250] (Execution with Unnecessary Privileges), indicating the tool performs operations with elevated rights that should be more tightly scoped. Exploitation requires local access and some user interaction, limiting remote attack feasibility. The vendor advisory was published through Broadcom Security Advisory #37625.

Critical Impact
A local attacker with limited privileges can escalate to administrative control on macOS systems running vulnerable CleanWipe versions, compromising confidentiality, integrity, and availability of the host.

Affected Products

CleanWipe Removal Tool for macOS, versions prior to 16.0.0.65
Broadcom-distributed Symantec endpoint cleanup utility
macOS hosts where CleanWipe is executed for product removal

Discovery Timeline

2026-06-10 - CVE-2026-11626 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11626

Vulnerability Analysis

The CleanWipe Removal Tool is a utility used to remove Symantec endpoint products from macOS systems. To perform its cleanup tasks, it requires elevated privileges to delete protected files, services, and configuration data. The vulnerability arises because the tool executes operations with broader privileges than necessary, falling under the [CWE-250] weakness class.

An attacker with a low-privileged local account can abuse this design flaw to perform actions as an administrative user. The result is a complete compromise of the local privilege boundary, allowing the attacker to read, modify, or delete data and install persistent components.

Root Cause

The root cause is execution with unnecessary privileges. CleanWipe performs sensitive removal operations while running with elevated rights, and access to those operations is not adequately restricted. When a local user can influence the tool's actions or input paths, the elevated context becomes available to that user.

Attack Vector

Exploitation requires local access to the macOS host and user interaction with the CleanWipe tool. The attack complexity is low, but successful exploitation depends on specific preconditions on the target system. No network access is required, and no public proof-of-concept is currently available.

No verified exploitation code is published for CVE-2026-11626. Refer to the Broadcom Security Advisory #37625 for vendor-provided technical detail.

Detection Methods for CVE-2026-11626

Indicators of Compromise

Execution of CleanWipe binaries by non-administrative users on macOS endpoints
Unexpected sudo or launchctl activity correlated with CleanWipe processes
Creation of new administrator accounts or modifications to /etc/sudoers shortly after CleanWipe execution
CleanWipe versions older than 16.0.0.65 present in software inventory

Detection Strategies

Inventory macOS endpoints for CleanWipe and flag installations below version 16.0.0.65
Monitor process telemetry for CleanWipe spawning child processes with elevated UIDs
Alert on writes to protected system paths originating from removal-tool processes

Monitoring Recommendations

Forward macOS Endpoint Security Framework (ESF) and Unified Log events to a centralized SIEM
Track privilege transitions from standard users to root initiated by helper or installer binaries
Review audit logs for anomalous use of administrative tools immediately following CleanWipe runs

How to Mitigate CVE-2026-11626

Immediate Actions Required

Upgrade CleanWipe Removal Tool to version 16.0.0.65 or later on all macOS hosts
Restrict access to the CleanWipe binary so only administrators can execute it
Remove unused copies of CleanWipe from endpoints after product removal is complete
Audit local user accounts for unexpected administrative group membership

Patch Information

Broadcom has released a fixed version of CleanWipe Removal Tool that addresses CVE-2026-11626. Administrators should obtain version 16.0.0.65 or later directly from the vendor. See the Broadcom Security Advisory #37625 for download and remediation guidance.

Workarounds

Do not distribute CleanWipe to standard users; require administrators to run removal operations
Store CleanWipe in an access-controlled location and remove it after use
Apply macOS endpoint hardening to limit privilege escalation primitives available to local users

bash

# Check the installed CleanWipe version on macOS
/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" \
  "/Applications/CleanWipe.app/Contents/Info.plist"

# Restrict execution to administrators only
sudo chown root:admin /Applications/CleanWipe.app/Contents/MacOS/CleanWipe
sudo chmod 750 /Applications/CleanWipe.app/Contents/MacOS/CleanWipe