CVE-2026-39118: Kandji Agent Privilege Escalation Bug - What It Means for Your Business and How to Respond

Introduction

A recently disclosed vulnerability in Kandji Agent, a popular macOS device management solution, highlights the persistent risks associated with endpoint management tools in modern enterprises. CVE-2026-39118 allows a local attacker with standard user access on an affected macOS device to escalate privileges and invoke restricted agent functions. Organizations in the United States and Canada relying on Kandji for fleet management, policy enforcement, and security controls face potential exposure if unpatched agents remain in use. This post explains the issue in business terms, assesses impacts on operations and compliance, and provides clear guidance on verification and remediation. While the vulnerability requires local access, its implications for device security and data protection demand prompt attention from leadership and IT teams.

S1 — Background & History

Kandji Agent, developed by Iru, Inc., serves as the client-side component for Kandji’s MDM platform, enabling centralized management of macOS devices across enterprises. The vulnerability was publicly published on June 15, 2026, with an update the following day. It affects versions of the agent prior to 4.7.5(5374). Security researchers at XM Cyber identified the issue through analysis of macOS behaviors, including XPC interfaces and code-signing mechanisms, which contributed to the flaw’s discovery.

In plain terms, the bug stems from insufficient validation of requests sent to privileged components of the agent. This allows a local user to bypass intended restrictions and perform actions that should require higher authorization. The National Vulnerability Database assigned a CVSS v3 base score of 7.8 (High severity), reflecting local attack vector, low complexity, and significant impacts on confidentiality, integrity, and availability. No remote exploitation is possible without initial local access. The vendor responded quickly with a patch, underscoring the importance of timely updates in device management ecosystems. Organizations using Kandji in regulated sectors should note this timeline, as delayed patching could intersect with compliance audit periods.

S2 — What This Means for Your Business

If your organization manages macOS devices with Kandji, an unpatched agent creates a pathway for privilege escalation on individual endpoints. A user with basic local access—such as an employee, contractor, or compromised account—could potentially trigger restricted operations. This might include altering system configurations, disabling security features, or executing commands with elevated rights, leading to unauthorized data access or changes.

Operationally, this disrupts device trust and management consistency. In industries like finance, healthcare, or professional services common in the U.S. and Canada, compromised endpoints can lead to data exposure, service interruptions, or failures in policy enforcement. For example, security controls intended to protect sensitive client information or intellectual property could be bypassed, increasing breach likelihood.

Reputationally, incidents tied to known vulnerabilities invite scrutiny from partners, regulators, and customers. Compliance with frameworks such as HIPAA, PCI-DSS, SOC 2, or Canadian privacy laws becomes harder to demonstrate if patching lags. Legal and financial consequences may follow data incidents, including notification requirements and potential fines. Even without immediate exploitation, the presence of vulnerable agents signals gaps in vulnerability management programs, which auditors increasingly examine. Businesses with hybrid or remote workforces face amplified risk, as physical or logical local access is more common than in fully locked-down environments. Prioritizing this remediation protects continuity and maintains stakeholder confidence.

S3 — Real-World Examples

Financial Services Firm: A regional bank with hundreds of employee MacBooks running vulnerable Kandji Agent versions experiences unauthorized configuration changes on a loan officer’s device. The escalation allows bypassing encryption policies, exposing customer financial data and triggering regulatory reporting obligations under U.S. banking rules.

Healthcare Provider: A mid-sized clinic in Canada discovers anomalous activity on a physician’s workstation after a staff member with local access exploits the flaw. Restricted agent functions are invoked to disable monitoring, potentially compromising protected health information and violating HIPAA-equivalent requirements, leading to internal investigations and remediation costs.

Professional Services Company: A consulting firm with distributed teams finds that a contractor’s device was used to alter security settings via the agent. This results in temporary loss of visibility into endpoint compliance, delaying client deliverables and raising concerns during a SOC 2 audit preparation.

Manufacturing Enterprise: A U.S. manufacturer with engineering teams using macOS for design work faces privilege escalation that interferes with device policies. Intellectual property on affected systems becomes vulnerable, highlighting risks in supply chain and R&D environments where endpoint security underpins competitive advantage.

S4 — Am I Affected?

• You are running Kandji Agent versions prior to 4.7.5(5374) on any macOS endpoints.
• Your organization uses Kandji MDM for device enrollment, policy management, or security controls.
• Standard user accounts have interactive or local access to managed Mac devices.
• You have not verified and applied the vendor patch across your fleet within the last month.
• Your compliance or risk management processes include macOS endpoints without recent agent version audits.

If none of the above apply, your environment is likely not directly affected by this specific CVE.

Key Takeaways

• CVE-2026-39118 creates a local privilege escalation risk in unpatched Kandji Agent deployments, potentially undermining endpoint security controls.
• Businesses face operational disruptions, data exposure, and compliance challenges if vulnerable agents remain active on macOS fleets.
• Prompt patching and verification are essential to restore trusted management and reduce exposure.
• Local access scenarios, common in enterprise environments, make proactive fleet management a business imperative.
• Partnering with cybersecurity experts helps strengthen overall posture beyond single-vulnerability fixes.

Call to Action

Strengthen your organization’s defenses by addressing CVE-2026-39118 and similar endpoint risks with expert guidance. Contact IntegSec today for a comprehensive penetration test tailored to your macOS and MDM environment. Our team delivers actionable insights that reduce risk and support secure operations. Visit https://integsec.com to schedule your assessment and take confident steps toward robust cybersecurity.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause lies in improper privilege management (CWE-269) within the Kandji Agent’s handling of client requests to privileged services, particularly XPC interfaces on macOS. Affected components include the agent daemon and associated services that run with elevated permissions. The attack vector is local, with low complexity and no required user interaction beyond initial local access (PR:L). The CVSS v3 vector is approximately AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation allows invocation of restricted functionality intended for authenticated or privileged contexts. NVD references provide official details, and the issue ties into broader macOS behaviors such as code-signing trust cache persistence.

B — Detection & Verification

Version enumeration:

text

/usr/local/bin/kandji --version

Compare output against 4.7.5(5374) or later.

Scanner signatures: Look for signatures targeting Kandji Agent XPC services or client validation bypass patterns in tools such as vulnerability scanners configured for macOS MDM.

Log indicators: Review system logs for unexpected invocations of privileged agent functions (e.g., io.kandji.* services) from non-standard processes or user sessions. Check for anomalous process ancestry involving the agent daemon.

Behavioral anomalies: Monitor for agent-initiated changes outside scheduled MDM tasks, unsigned processes communicating with agent IPC, or modifications to security frameworks like Endpoint Security.

Network exploitation indicators: None, as the issue is strictly local. Focus on endpoint telemetry for local IPC activity.

C — Mitigation & Remediation

1. Immediate (0–24h): Deploy the official patch to Kandji Agent 4.7.5(5374) or later via the Kandji console across all managed endpoints. Verify successful rollout and agent version reporting. Audit recent privileged activity logs for signs of prior abuse.
2. Short-term (1–7d): Restrict local interactive access on sensitive devices to trusted administrators where operationally feasible. Implement application allowlisting to limit untrusted binaries interacting with the agent. Scan the fleet for any remaining vulnerable versions and enforce updates.
3. Long-term (ongoing): Integrate agent version monitoring into configuration management and compliance dashboards. Adopt least-privilege principles for user accounts on macOS devices. Conduct regular penetration testing of MDM and endpoint configurations. For environments unable to patch immediately, limit exposure by isolating affected devices and enhancing monitoring of agent IPC and process execution, though patching remains the primary remediation. Follow vendor release notes at the provided IRU update link.

D — Best Practices

• Enforce strict version control and automated patching for all MDM agents in your fleet.
• Implement robust endpoint monitoring focused on privileged service interactions and anomalous local activity.
• Apply principle of least privilege to user accounts and limit local access on managed devices.
• Regularly test MDM configurations through simulated attacks to identify validation gaps.
• Maintain comprehensive asset inventories that track agent versions and integrate with vulnerability management processes.