macOS Trust Cache Abuse Lets Standard Users Disable EDR and MDM Tools

Researchers at XM Cyber disclosed a macOS privilege-escalation technique that allows a standard, non-administrative user to disable enterprise security software and invoke privileged functions without administrator credentials or kernel exploits. The attack chain abuses legitimate macOS behavior by combining weakly validated XPC connections, malicious payload injection into Interface Builder NIB files, and a newly described misuse of the kernel code-signing trust cache, which can continue trusting an application's CDHash after a legitimately signed app has run.

XM Cyber said it successfully used the method to silently unload or permanently deactivate CrowdStrike Falcon Sensor, Kandji MDM, and a third unnamed EDR product without triggering alerts. Kandji addressed the issue in an updated agent release and assigned CVE-2026-39118, CrowdStrike reportedly paid a bug bounty and added detections while disclosure continues, and another vendor is developing a patch; XM Cyber also warned that Apple does not plan to remediate the underlying macOS design issue, leaving software vendors to implement their own mitigations.