Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Kandji security patch release for CVE-2026-39118

Security Patch Release
First reported
Last updated
Happening score
H score 17
1 unique sources, 1 articles

Summary

Hide ▲

Kandji fixed its MDM agent on macOS and assigned CVE-2026-39118 after validation showed a trust issue that could let a standard user disable enterprise security controls. The patch closes a macOS agent weakness exposed through XPC trust handling. The broader research showed the same technique can undermine tamper protection and remove visibility from security products.

Related Happenings

MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage

Technical Analysis
H score23 First: 24.06.2026 17:00 Last: 24.06.2026 17:00 Sources 1

About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...

Open Happening

Ivanti Sentry patch release for CVE-2026-10520 and CVE-2026-10523

Security Patch Release
H score54 First: 10.06.2026 09:26 Last: 10.06.2026 09:26 Sources 1

About this happening: Ivanti released a patch bundle for Sentry after identifying two critical vulnerabilities in the secure mobile gateway appliance, including CVE-2026-10520 and *...

Open Happening

Ivanti EPMM patch release for CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821

Security Patch Release
H score66 First: 07.05.2026 18:20 Last: 07.05.2026 18:20 Sources 1

About this happening: Ivanti released a security update for on-prem Endpoint Manager Mobile (EPMM) covering CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821. The patch addresses high-seve...

Latest development: 07.05.2026 20:55

Ivanti released fixes for CVE-2026-5786, CVE-2026-5787, CVE-2026-5788, and CVE-2026-7821 in Endpoint Manager Mobile (EPMM). The updates apply only to on-prem EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1, and Ivanti said the issues are not present in Ivanti Neurons for MDM, Ivanti EPM, Ivanti Sentry, or other Ivanti products.

Open Happening

Microsoft April 2026 Patch Tuesday security updates (167 flaws)

Security Patch Release
H score55 First: 14.04.2026 20:41 Last: 14.04.2026 20:41 Sources 1

About this happening: Microsoft's April 2026 Patch Tuesday ships security updates for 167 flaws, including 2 zero-days, reducing exposure across widely used Microsoft software. The rele...

Open Happening

Hewlett Packard Enterprise (HPE) security patch release for CVE-2026-23813

Security Patch Release
H score69 First: 10.03.2026 19:30 Last: 10.03.2026 19:30 Sources 1

About this happening: HPE released security updates for Aruba Networking AOS-CX, closing multiple vulnerabilities including authentication and code execution issues on CX-series campu...

Open Happening

Timeline

  1. 25.06.2026 14:00 2 articles · 20d ago

    Kandji fixes MDM agent flaw assigned CVE-2026-39118

    Mitigation Patch Update

    Kandji's macOS MDM agent was fixed after XM Cyber identified a macOS XPC trust issue that let a standard local user call privileged helper functions without authentication and disable or remove EDR/MDM tools. The flaw was assigned CVE-2026-39118, and the remediation centers on validating the caller's identity during the XPC handshake instead of trusting cached signatures.

    Show sources
    Open in new tab