CVE-2026-22926: Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability

Synopsis

A local privilege escalation vulnerability affects Omnissa Workspace ONE Assist for macOS. The vulnerability is reached locally, meaning an attacker must already have a low-privilege account or process on the host, and no additional authentication beyond that is required. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the affected system, effectively elevating to root or equivalent privileges. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger this vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or root credentials to initiate the exploit.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can exploit the vulnerability without any victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads sensitive files, credentials, and secrets accessible on the host, including those normally restricted to root or privileged users.
• Modifies or overwrites system files, configuration, and persisted application data across the host.
• Crashes or terminates system services, rendering the affected macOS endpoint unavailable.
• Establishes persistent elevated access that survives reboots or user session changes.