CVE-2026-86819
Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
| CWE | CWE-862 |
| Vendor | waves audio ltd. |
| Product | waves central |
| Published | Sep 8, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for waves audio ltd. waves central
Be the first to know when new high vulnerabilities affecting waves audio ltd. waves central are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
Waves Audio Ltd. / Waves Central
16.6.2 < 17.0
References
Credits
Shravan Kumar Sheri, Independent Security Researcher