Read the docs
TI-2024-10629 Aliases CVE-2024-11468GHSA-9m2c-r2hc-7gcr

Incorrect default permissions in Omnissa Horizon Client for MacOS

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installation process. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OmnissaOmnissa Horizon Client for MacOSOmnissa Horizon Client for macOS 2406 or earlier—No fix listedCNA
  • Omnissa Horizon Client for MacOS VendorOmnissa Affected Omnissa Horizon Client for macOS 2406 or earlier Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11468
  2. 2026-10-03 Alias added: GHSA-9m2c-r2hc-7gcr

References

Other 2

  • TI-2021-05093 Server-side request forgery in VMware Workspace ONE UEM console KEVCVSS 3.1HIGH 7.5
  • TI-2025-18899 Path traversal in Omnissa Workspace ONE UEM CVSS 3.1HIGH 7.5
  • TI-2025-18901 Omnissa Secure Email Gateway (SEG) updates address Server-Side Request Forgery (SSRF) vulnerability CVSS 3.1HIGH 8.6
  • TI-2026-18412 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. CVSS 3.1HIGH 7.8
  • TI-2026-18411 Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability. CVSS 3.1HIGH 7.8
  • TI-2025-18898 Improper privilege management in Omnissa Horizon Client for Windows CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences