Executive brief
A security vulnerability in the Kandji Agent for macOS could allow a person with standard user access to a computer to gain unauthorized control over restricted management functions. This agent is used by organizations to manage and secure Apple devices across their workforce. If exploited, an attacker could potentially disrupt device operations or bypass security configurations managed by the software.
Technical details
A privilege escalation vulnerability exists in the Kandji Agent for macOS prior to version 4.7.5 (5374). The flaw stems from an access control issue and a client validation gap, which allows a local attacker with standard user privileges to invoke restricted agent functionality. By exploiting this lack of proper validation, an attacker can perform actions typically reserved for higher-privileged management processes, potentially impacting system availability or integrity. The issue has been addressed in version 4.7.5 (5374) by implementing improved validation mechanisms.
Affected products
- Iru, Inc. Kandji Agent before 4.7.5 (5374)
Timeline
- 2026-03-25: patched: Fix released in version 4.7.5 (5374)
- 2026-06-15: disclosed: CVE published to NVD