ESET Customer Advisory: Local privilege escalation vulnerability in ESET security products for macOS fixed - Nieuws / Customer Advisories - ESET Tech Center

jul 24 2026

ESET Customer Advisory: Local privilege escalation vulnerability in ESET security products for macOS fixed

Geschreven door Steef | ESET Nederland
Categorie: Customer Advisories

ESET Customer Advisory 2026-0014

July 24, 2026

Severity: High

Summary

A report of a local privilege escalation was submitted to ESET by daik0n and z7p3n of the Kuaishou Client Security Team. The vulnerability potentially allowed an attacker to execute arbitrary code as a privileged user. ESET mitigated this by preparing fixed versions of the affected products.

Details

On systems with the affected ESET products installed, it was possible for an unprivileged local user to execute arbitrary code. This was achieved through a helper binary inside the ESET Uninstaller application bundle, running with root permissions, which allowed arbitrary command injection when parsing directory names containing shell metacharacters. An attacker could exploit this by creating a specially crafted directory name to execute arbitrary code as root, resulting in local privilege escalation.

The reserved CVE ID for this vulnerability is CVE-2026-10610, the CVSS v4.0 score is 8.5, with the following vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

To the best of our knowledge, no exploits exist in the wild that target this vulnerability.

Solution

ESET prepared fixed builds of the affected products and recommends upgrading to these or scheduling the upgrades in the near future. The fixed builds are available to download from www.eset.com or via ESET Repository.

ESET Endpoint Security for macOS
- version 9.1.3100.0 and later from the 9.1 version family
- version 9.0.6400.0 and later from the 9.0 version family
- version 8.1.300.0 and later from the 8.1 version family
ESET Cyber Security for macOS
- version 9.0.6300.0 and later

Affected Products

NOTE:

ESET product versions that no longer receive hotfixes according to the End of Life policy may not be listed.

ESET Endpoint Security for macOS
- version 9.1.2500.0 and earlier from the 9.1 version family
- version 9.0.5400.0 and earlier from the 9.0 version family
- version 8.1.200.0 and earlier from the 8.1 version family

ESET Cyber Security for macOS
- version 9.0.5300.0 and earlier

Feedback & Support

If you have feedback or questions about this issue, please contact us using the ESET Security Forum, or via local ESET Technical Support.

Acknowledgement

ESET values the principles of coordinated disclosure within the security industry and would like to express our thanks to daik0n and z7p3n of the Kuaishou Client Security Team.

Version log

Version 1.0 (July 24, 2026): Initial version of this document