CVE-2026-26225 is a high-severity local privilege escalation vulnerability affecting Intego Personal Backup, a macOS utility used for scheduled backups and creating bootable system clones. The root cause is improper link resolution before file access (CWE-59), where backup task definitions are stored in a location writable by non-privileged users but processed with elevated privileges. This design flaw allows a local attacker to craft a malicious serialized task file that, when processed by the backup software running with elevated privileges, can trigger arbitrary file writes to sensitive system locations. Such arbitrary writes can overwrite critical system files or place malicious binaries, enabling the attacker to escalate privileges to root. The vulnerability does not require user interaction or authentication, but local access is necessary. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects that the attack requires low complexity and privileges but results in high confidentiality, integrity, and availability impact. No patches or exploits are currently publicly available, but the vulnerability's nature makes it a significant risk for macOS environments using this backup software.

The vulnerability allows local attackers to escalate privileges to root by exploiting improper file handling in Intego Personal Backup. This can lead to full system compromise, including unauthorized access to sensitive data, installation of persistent malware, and disruption of system availability. Organizations relying on this backup solution may face risks of insider threats or attackers who gain initial local access through other means. The ability to write arbitrary files with root privileges can bypass many security controls, potentially undermining system integrity and confidentiality. This threat is particularly critical for environments where Intego Personal Backup is used on macOS endpoints, including enterprise workstations and servers. The lack of required user interaction or authentication increases the risk of automated or stealthy exploitation once local access is obtained.

Organizations should immediately review the usage of Intego Personal Backup on macOS systems and restrict access to the backup task definition files to trusted administrators only. Implement strict file system permissions to prevent non-privileged users from writing to locations processed with elevated privileges. Monitor and audit changes to backup task files for suspicious modifications. Until a vendor patch is available, consider disabling or uninstalling the Intego Personal Backup software on critical systems to eliminate the attack vector. Employ endpoint detection and response (EDR) tools to detect anomalous file writes or privilege escalation attempts. Educate users about the risks of local access and enforce least privilege principles to minimize the number of users with local access rights. Regularly check for vendor updates or security advisories to apply patches promptly once released.