Security firm XM Cyber found a macOS technique that can let standard user accounts disable some enterprise security tools without administrator credentials.
Researchers disclosed the findings ahead of a planned Black Hat Arsenal presentation in August, where they'll demonstrate an open-source tool called XPC Hunter. XM Cyber reported successful attacks against CrowdStrike Falcon and Kandji on macOS.
The firm's reported technique isn't a remote attack. Researchers said attackers must first gain access to a standard user account on the target Mac.
Requiring access to an existing account limits the attack's reach, but it doesn't make the research insignificant. Attackers who gain access to a Mac often try to disable monitoring tools before moving deeper into a system or network.
XM Cyber unloaded the CrowdStrike Falcon security sensor from a standard user account by abusing a privileged XPC method. Researchers also disabled Kandji's uninstall protections and deactivated endpoint protection features through a separate chain of privileged XPC calls.
Neither demonstration required a kernel exploit or a System Integrity Protection bypass, according to the report. Kandji has since fixed the reported vulnerability and assigned CVE-2026-39118 in the public database of known computer exploits.
XM Cyber disclosed the findings to affected vendors before publication. Apple hasn't published a security advisory tied to the research or independently validated XM Cyber's findings.
The research focuses on trusted macOS communication channels
XPC is Apple's framework for communication between applications and background services. Developers commonly use XPC to let apps request administrative actions while keeping privileged functions separate from user-facing software.
XM Cyber argues that some developers rely too heavily on code-signing trust when deciding which software can call sensitive XPC methods. Researchers said the technique targets how some applications verify requests sent to privileged services.
The attack starts when a user launches a legitimate signed application and macOS caches its trust fingerprint. Researchers claim an attacker can then modify parts of the application bundle with a malicious payload while retaining that trust relationship.
The cached trust relationship can reportedly allow a standard user account to invoke privileged XPC methods normally reserved for trusted software components. XM Cyber argues the issue stems from how some applications establish trust rather than from a direct bypass of macOS security protections.
The attack starts when a user launches a legitimate signed application and macOS caches its trust fingerprintResearchers also argue the issue extends beyond two specific products. If that assessment proves accurate, Mac developers may need stronger ways to verify requests sent to privileged services instead of relying primarily on code-signing checks.
Why the reported attack matters to enterprise Mac deployments
CrowdStrike Falcon, Kandji, and similar products help organizations monitor devices, enforce security policies, and respond to threats across large fleets of Macs.
The findings arrive as Macs continue gaining traction in enterprise environments. Security software and management agents are often the systems standing between a compromised user account and deeper access to company data.
The lack of administrator credentials is what makes the research notable. Many enterprise defenses assume standard users can't directly unload endpoint protection tools or bypass device management restrictions.
Kandji's CVE assignment also gives the research additional weight because at least one vendor has acknowledged and fixed a specific vulnerability identified through the technique.
Vendors are still investigating the broader findings, and Apple hasn't issued its own advisory. Privileged XPC services can become an attack surface when developers don't verify callers carefully enough.
XM Cyber plans to release XPC Hunter at Black Hat Arsenal in Las Vegas on August 5. Researchers will demonstrate the tool and discuss the macOS XPC attack technique in greater detail.
How Mac users can protect themselves
XM Cyber's research requires attackers to gain access to an existing user account before they can use the reported technique. Strong passwords and multi-factor authentication can reduce the chances of an attacker gaining that initial foothold.
Mac users should also keep security software, device management tools, and macOS itself up to date as vendors investigate the findings and release fixes.
Organizations that manage large Mac deployments should review vendor guidance for additional mitigations and security updates. The research highlights the importance of limiting user privileges and treating trusted application communications as a potential attack surface.
