CVE-2026-2638

Description

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

References

• https://fluidattacks.com/es/advisories/soad
• https://xvpn.io/
• https://xvpn.io/download/vpn-mac
• https://xvpn.io/resources/statement-local-privilege-escalation-vulnerability
• https://fluidattacks.com/es/advisories/soad