Read the docs
TI-2026-21215 Aliases CVE-2026-26224GHSA-h5j4-jj3m-xgpg

Intego Log Reporter TOCTOU Local Privilege Escalation

Priority HIGH 72CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Intego Log Reporter, a macOS diagnostic utility bundled with Intego security products that collects system and application logs for support analysis, contains a local privilege escalation vulnerability. A root-executed diagnostic script creates and writes files in /tmp without enforcing secure directory handling, introducing a time-of-check to time-of-use (TOCTOU) race condition. A local unprivileged user can exploit a symlink-based race condition to cause arbitrary file writes to privileged system locations, resulting in privilege escalation to root.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00123 2nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IntegoLog Reporterall versions—No fix listedCNA
  • Log Reporter VendorIntego Affected all versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26224
  2. 2026-10-03 Alias added: GHSA-h5j4-jj3m-xgpg

References

Exploit 1

Other 2

  • TI-2026-69739 Link following in Intego Antivirus enables local privilege escalation CVSS 4.0HIGH 8.5
  • TI-2026-21216 Intego Personal Backup Task File Privilege Escalation CVSS 4.0HIGH 8.5
  • TI-2006-05699 Intego VirusBarrier X4 allows context-dependent attackers to bypass virus protection by… CVSS 2.0MEDIUM 5.0
  • TI-2001-01119 Intego FileGuard 4.0 uses weak encryption to store user information and passwords, which… CVSS 2.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences