CVE-2026-18367 - A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6

Back Back to CVE browser

CRITICAL

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6

Published Aug 6, 2026

9.3

CRITICAL

CVSS 3.1

EPSS 0.18%

Description

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.

Affected products

Vendor Sophos Product Sophos Endpoint for macOS Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2026.1.1
Vendor Sophos Product Sophos Home for macOS Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <10.11.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sophos

Sophos Endpoint for macOS

unaffected

Version	Status	Constraints
0	affected	<2026.1.1

Sophos

Sophos Home for macOS

unaffected

Version	Status	Constraints
0	affected	<10.11.6

Remediation

No remediation recorded yet.

Metrics

0.18% 0.00177

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00177

Score over time

Aug-Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (2 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.18% (0.00177)	6.55th	v5 (v2026.06.15)
Aug 7, 2026	0.13% (0.00131)	3.10th	v5 (v2026.06.15)

Weaknesses (1)

CWE-285

References (1)

https://www.sophos.com/security-advisories/sophos-sa-20260806-ep-macos-lpe

Link	Providers	Tags
https://www.sophos.com/security-advisories/sophos-sa-20260806-ep-macos-lpe

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Sophos

Published Aug 6, 2026

Updated Aug 7, 2026

Reserved Jul 30, 2026

Link CVE-2026-18367

CISA Vulnrichment

Updated Aug 7, 2026

NVD

Status Awaiting Analysis

Modified Sep 1, 2026

Link CVE-2026-18367

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-18367