CVE-2026-2638

CVE-2026-2638

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

Weakness classification (CWE)

References