Security researchers at XM Cyber have publicly disclosed CVE-2026-39118, a macOS vulnerability that allows a standard (non-root) user to silently disable Endpoint Detection and Response (EDR) and Mobile Device Management (MDM) solutions — including CrowdStrike Falcon and Kandji — without triggering alerts or leaving meaningful forensic traces.
The attack chains three legitimate macOS behaviors: weak XPC service validation, malicious payload injection via NIB files, and abuse of the kernel’s code-signing trust cache. Together, these allow a low-privilege user to impersonate trusted application components and call privileged functions that unload security agents entirely. XM Cyber demonstrated the technique against CrowdStrike Falcon (fully unloaded — no detection, process monitoring, or network visibility), Kandji MDM (permanently deactivated), and at least one unnamed enterprise EDR vendor currently developing a patch.
Source
Dark Reading · SecurityWeek · Infosecurity Magazine
Commentary
This is an offensive operator’s dream and a blue team’s nightmare. Being able to kill EDR from a standard user account — with no forensic trace — fundamentally undermines the detection stack on macOS endpoints. CrowdStrike and Kandji have shipped mitigations, but Apple has publicly stated it does not plan to fix the underlying design issue, leaving every macOS security vendor playing whack-a-mole with XPC trust validation.
XM Cyber researcher Hillel Pinto plans to release an open-source tool called XPC Hunter at Black Hat US in August 2026 that can scan macOS applications for similar weaknesses. Red teams should watch that release closely. Defenders running macOS fleets should verify their EDR vendor has addressed this specific attack chain and consider layered monitoring that does not rely solely on the endpoint agent staying alive.