CVE-2026-78237: ABR Privilege Escalation Vulnerability

CVE-2026-78237 Overview

CVE-2026-78237 is a local privilege escalation vulnerability in Admin By Request (ABR) for macOS. Insufficient input validation allows a low-privileged user to inject malicious entries into the sudoers file during an elevated session. The injected entries persist after the ABR session terminates, granting the attacker durable root access on the affected system. The flaw is categorized under CWE-20: Improper Input Validation and carries a local attack vector with high impact on confidentiality, integrity, and availability.

Critical Impact
Attackers with low privileges can obtain persistent root access on macOS endpoints, surviving reboots and ABR session termination.

Affected Products

Admin By Request (ABR) client for macOS
See the Admin by Request Security Advisory for affected build ranges
Refer to CSA Alert AL-2026-110 for regional guidance

Discovery Timeline

2026-08-26 - CVE-2026-78237 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78237

Vulnerability Analysis

Admin By Request is a privileged access management tool that temporarily elevates standard users to administrative privileges for approved tasks. During an elevated ABR session on macOS, the product handles user-controlled input that is ultimately reflected into the /etc/sudoers configuration. The elevation flow does not adequately sanitize this input, so a low-privileged user can craft entries that add themselves, or another account, to the sudoers policy with NOPASSWD root privileges.

Because /etc/sudoers is a persistent configuration file, the malicious entries remain effective after the ABR session ends and after reboot. This converts a time-boxed, audited elevation into an unaudited, permanent local root capability. The vulnerability requires local access and low privileges, but no user interaction, and its scope changes because the compromise crosses from the ABR-managed elevation context into the host operating system's authorization subsystem.

Root Cause

The root cause is improper input validation [CWE-20] in the ABR elevation workflow. User-influenced data reaches sudoers modification logic without strict allow-list validation, escaping, or structural parsing of sudoers syntax.

Attack Vector

An authenticated local user initiates a legitimate ABR elevation request. During or through that session, the attacker supplies input that ABR incorporates into /etc/sudoers, appending an entry that grants the attacker's account passwordless sudo access. After the ABR session closes, the attacker invokes sudo and receives a root shell. No verified public proof-of-concept is available at the time of publication.

Detection Methods for CVE-2026-78237

Indicators of Compromise

Unexpected modifications to /etc/sudoers or files under /etc/sudoers.d/ outside of change-management windows
New NOPASSWD entries referencing non-administrative user accounts
sudo invocations by standard users immediately following an ABR elevation session
ABR audit logs showing elevated sessions that lack a corresponding approved task

Detection Strategies

Monitor filesystem events on /etc/sudoers and /etc/sudoers.d/* using macOS Endpoint Security or EDR file integrity telemetry
Alert on process chains where ABR helper processes write to sudoers-related paths
Correlate ABR session end events with subsequent successful sudo executions by the same user
Baseline authorized sudoers content and flag any diff introduced during or after an ABR session

Monitoring Recommendations

Forward macOS auth.log equivalents, sudo invocation events, and ABR audit logs into a central SIEM for correlation
Retain ABR session metadata alongside endpoint process telemetry to reconstruct elevation-to-persistence chains
Review privileged access reports weekly for accounts that gained sudo rights outside the standard provisioning workflow

How to Mitigate CVE-2026-78237

Immediate Actions Required

Upgrade the Admin By Request macOS client to the fixed version listed in the Admin by Request Security Advisory
Audit /etc/sudoers and /etc/sudoers.d/ on all macOS endpoints running ABR and remove unauthorized entries
Rotate credentials for any account that gained unexpected sudo privileges
Review ABR elevation logs for the past 90 days to identify suspicious sessions

Patch Information

Admin By Request has published fixed macOS client builds in advisory ABR-MAC-26-02. Consult the vendor advisory for the exact fixed version and deployment guidance before rolling out through your MDM.

Workarounds

Restrict ABR usage on macOS endpoints to users with a documented business need until patched builds are deployed
Deploy a configuration profile that enforces read-only monitoring of /etc/sudoers and alerts on modification
Require secondary approval for ABR elevation requests on high-value macOS systems

bash

# Verify sudoers integrity and enumerate NOPASSWD entries on macOS
sudo visudo -c
sudo grep -RIn 'NOPASSWD' /etc/sudoers /etc/sudoers.d/ 2>/dev/null
sudo ls -la /etc/sudoers /etc/sudoers.d/