Read the docs
TI-2026-69658 Aliases CVE-2026-11318GHSA-hvrh-p54p-hg8c

Deskin XPC Service Privilege Escalation via Unauthenticated Installer

Priority HIGH 72CWE-306Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Deskin through 3.3.4.3 contains a privilege escalation flaw in the com.deskin.service.installer XPC service. The weakness is CWE-306 (Missing Authentication for Critical Function): the root-owned service accepts connections without authentication, so a local unprivileged attacker can invoke its privileged installer method, run an attacker-supplied installer as root and gain full root control of the macOS host. CISA's SSVC assessment rates exploitation as PoC, automatable as no and technical impact as total. The vulnerability is not in CISA KEV, and the references include a link to exploit code.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zuler TechnologyDeskInup to 3.3.4.3—No fix listedCNA
  • DeskIn VendorZuler Technology Affected up to 3.3.4.3 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Deskin by Zuler Technology. Remove or restrict the com.deskin.service.installer XPC service until a fix is available, and check the vendor for an update.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-11318
  2. 2026-10-09 Alias added: GHSA-hvrh-p54p-hg8c
  3. 2026-10-09 CISA SSVC decision points changed
  4. 2026-10-09 Priority changed: MEDIUM → HIGH

References

Exploit 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences