Overview
- XM Cyber disclosed in late June that its researchers can use a standard, non‑administrator account to silently unload or deactivate enterprise EDR and MDM agents without using a kernel exploit.
- The chain works by abusing macOS behaviors: the kernel caches a code‑signing fingerprint (CDHash) after a signed app runs and weak XPC caller validation lets a modified component call privileged helper methods.
- XM Cyber demonstrated the technique against CrowdStrike Falcon (fully unloading the sensor) and Kandji (permanently deactivating the MDM agent) and said a third unnamed vendor was also affected.
- Vendors have started to respond: Kandji issued a fix and logged CVE‑2026‑39118, CrowdStrike added detections and paid a bounty, and other firms are issuing patches while Apple had not published an advisory at the time of reporting.
- Because the method uses normal OS trust and XPC calls it can leave little forensic trace, so organizations should audit XPC caller validation, apply vendor fixes, limit user privileges, and enforce strong account hygiene such as MFA.