This vulnerability (CVE-2026-18367) arises from Sophos Endpoint for macOS and Sophos Home for macOS not performing or incorrectly performing authorization checks when a local actor attempts to access resources or perform actions. This flaw enables local users to escalate privileges and execute arbitrary code as root. The affected versions are those prior to 2026.1.1 for Sophos Endpoint and prior to 10.11.6 for Sophos Home. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation level, and no exploits are currently known in the wild.

Successful exploitation allows a local user to gain root privileges and execute arbitrary code on the affected macOS systems running Sophos Endpoint or Sophos Home. This can lead to full system compromise, including unauthorized access, modification, or destruction of data and system resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user access to affected systems and monitor for suspicious activity related to privilege escalation attempts. Avoid running untrusted code locally on affected versions.