CVE-2026-11626 is a local privilege escalation vulnerability in the Broadcom Symantec Endpoint Protection CleanWipe Removal Tool for macOS. The issue arises from execution with unnecessary privileges (CWE-250), enabling an attacker with limited access to escalate privileges to administrative control. The vulnerability affects versions prior to 16.0.0.65. The CVSS 4.0 vector indicates local attack vector, low attack complexity, partial attack and user interaction required, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An attacker with limited privileges on an affected macOS system could exploit this vulnerability to gain administrative privileges, potentially allowing full control over the system. This could lead to unauthorized system modifications, data compromise, or disruption of security controls. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to trusted users only and monitor for suspicious privilege escalation attempts. Avoid running the CleanWipe Removal Tool on untrusted systems or by untrusted users.