Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Service Advisory

Due to a worldwide Microsoft Outlook disruption, emails to and from CSA may be delayed. We apologise for the inconvenience.

Cyber Security Agency of Singapore
Alerts

Vulnerabilities in Privileged Access Management Application “Admin By Request”

26 August 2026

Two vulnerabilities have been discovered in the privileged access management application “Admin By Request” (ABR). The product owner has rolled out fixes for both reported vulnerabilities. Special thanks to the researchers and ABR for coordinating through CSA's Responsible Vulnerability Disclosure Policy.

Background

Admin By Request (ABR) is a privileged access management solution that enables organisations to manage and control elevated access on endpoints such as Windows and macOS workstations, as well as on laptops used across the enterprise.

CVE ID – Description

CVE-2026-78236| 8.8 (High) - An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

CVE-2026-78237| 7.8 (High) – Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

Affected Versions

Both vulnerabilities affect ABR macOS versions 5.2.2 and below.

Mitigation

ABR, the product owner, has rolled out fixes for both reported vulnerabilities. Users and administrators of affected product versions are advised to update to the latest version promptly.

Timeline

  • 2026-04-28 – Vendor Disclosure

  • 2026- 06-22 – Vendor Patched

  • 2026- 08-25 – Public Release

Credit

Discovered by GovTech Cybersecurity Group

References

https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm (opens in new tab)

https://docs.adminbyrequest.com/security-advisories/abr-mac-26-02.htm (opens in new tab)