Vulnerability in X-vpn Macos Website
CVE-2026-2638
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
EPSS: 0.001 (0.4th percentile) — read the EPSS interpretation.
Affected products
- X-vpn Macos Website — versions 77.0
Weakness classification (CWE)
References
- help@fluidattacks.com (third-party-advisory)
- help@fluidattacks.com (product)
- help@fluidattacks.com (patch)
- help@fluidattacks.com (vendor-advisory)