This vulnerability (CVE-2026-18367) arises from Sophos Endpoint for macOS and Sophos Home for macOS not performing or incorrectly performing authorization checks when a local actor attempts to access resources or perform actions. This flaw enables local users to escalate privileges and execute arbitrary code as root. The issue affects versions prior to 2026.1.1 for Sophos Endpoint and prior to 10.11.6 for Sophos Home. The CVSS 3.1 vector indicates low attack complexity and no required privileges or user interaction, with a scope change and high impact on confidentiality, integrity, and availability. The vendor has not yet published a remediation level or patch information.

Successful exploitation allows a local attacker to gain root-level code execution on affected macOS systems running vulnerable versions of Sophos Endpoint or Sophos Home. This compromises the entire system's confidentiality, integrity, and availability. There are no reports of active exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious local activity related to Sophos Endpoint or Sophos Home on macOS.