Read the docs
TI-2024-04094 Aliases CVE-2024-4395GHSA-68wq-r58h-5q45

Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation

Priority HIGH 67CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed Jamf Compliance Editor (JAMF): 1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JamfJamf Compliance Editor1 to before 1.3.11.3.1Patch availableCNA
  • Jamf Compliance Editor VendorJamf Affected 1 to before 1.3.1 Fixed in 1.3.1 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:jamf:jamf_compliance_editor:1.3.1:*:*:*:*:*:*:*1.3.1—Jamf
  • cpe:2.3:a:jamf:jamf_compliance_editor:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 — ·Jamf

Remediation

  • Fix · CNA Jamf Compliance Editor (JAMF) Fixed in 1.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-4395
  2. 2026-10-03 Alias added: GHSA-68wq-r58h-5q45

References

Patch 2

Advisory 2

  • TI-2019-12743 An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. CVSS 3.1CRITICAL 9.8
  • TI-2021-16676 The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. CVSS 3.1CRITICAL 9.8
  • TI-2023-14930 There is broken access control during authentication in Jamf Pro Server before 10.46.1. CVSS 3.1CRITICAL 9.8
  • TI-2021-17742 An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. CVSS 3.1HIGH 8.8
  • TI-2018-07375 Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. CVSS 3.1HIGH 8.8
  • TI-2022-12012 Jamf Private Access before 2022-05-16 has Incorrect Access Control, in which an… CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences