CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)

Admin By Request (ABR) for macOS is affected by an insufficient input validation flaw (CVE-2026-78237, CVSS 7.8 HIGH ). A low-privileged local user can inject malicious entries into the sudoers file during an ABR session, granting persistent root access that remains effective even after the eleva...

CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication XPC while masquerading as an Apple-signed process...

CVE-2026-78236 Insecure PIN derivation mechanism in Admin By Request (ABR)

CVE-2026-78236 affects Admin By Request (ABR) , a macOS privilege-escalation utility. The root cause is an insecure PIN derivation mechanism that allows a low-privileged user to escalate to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service...

CVE-2019-17202

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service...

Privilege escalation

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a...

CVE-2019-17202

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a...

CVE-2019-17202

CVE-2019-17202 affects FastTrack Admin By Request 6.1.0.0. The vulnerability arises in the elevation flow: users without direct access to elevation are prompted for a PIN via a challenge–response. The challenge response uses a simple algorithm that can be emulated with data (customer ID and devic...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service...

CVE-2019-17201

FastTrack Admin By Request 6.1.0.0 has a privilege-escalation flaw in its elevation flow. The AdminByRequest.exe interface communicates with the underlying service Audckq32.exe via a .NET named pipe. The service relies on client-side validation and performs no local checks for elevation requests,...

PT-2020-9880 · Fasttrack · Fasttrack Admin By Request

Name of the Vulnerable Software and Affected Versions: FastTrack Admin By Request version 6.1.0.0 Description: The issue concerns a vulnerable exposed functionality in the underlying service of FastTrack Admin By Request. When a user requests elevation using the AdminByRequest.exe interface, it...