Researchers found a flaw that let a standard, non-admin Mac account silently disable CrowdStrike and Kandji protection...a wake-up call for Texas campuses that trust endpoint security to run untouched.
Picture a university IT security analyst opening a dashboard on a routine Monday and finding a lab Mac has gone dark, no telemetry, no alerts, for days. Not because of a sophisticated nation-state exploit, but because a curious undergraduate, logged in with an ordinary campus account, had switched off the very software meant to watch for exactly that kind of silence. That scenario is no longer hypothetical. Security firm XM Cyber has demonstrated a real technique letting a completely unprivileged macOS user account disable enterprise-grade endpoint protection without administrator rights, a kernel exploit, or tripping the alarms IT teams count on.
What happened
XM Cyber researchers found that building blocks of macOS's internal messaging system, known as XPC, can be chained together in a new way. Many Mac apps use XPC to let a visible window talk to a hidden background service running with deeper system privileges. Those services typically trust messages that appear to come from their own legitimate app, verified by a code signature check. An attacker with only a standard account can exploit lingering trust in that check, combined with injecting a tampered interface file into a legitimate, signed app, to impersonate a trusted process. Once that fake process is talking to the background service, it can issue commands that unload or permanently kill the security software.
The technique worked against CrowdStrike's Falcon sensor, fully unloading it from a standard account, and against Kandji's MDM agent, where a two-stage attack permanently deactivated the agent and killed the Endpoint Security Framework extension feeding it data. A third, unnamed EDR vendor was also successfully targeted. Because the exploit abuses legitimate macOS behavior rather than a traditional bug, it leaves little forensic trace and doesn't trigger the alerts organizations typically rely on.
The flaw affecting Kandji has been assigned CVE-2026-39118. Kandji has released a patch. CrowdStrike moved quickly, paid a bug bounty, and added detection and prevention across all supported versions of its macOS sensor. The unnamed third vendor is still working on a fix. Apple has indicated it will not change the underlying macOS design, leaving mitigation to security vendors. XM Cyber will release an open-source scanning tool, XPC Hunter, and present full details at Black Hat USA in August.
Why it matters for Texas institutions
Texas research universities, community colleges, and state agencies increasingly run mixed fleets with large numbers of Mac laptops and desktops in design studios, research labs, faculty offices, and administrative departments. Many rely on exactly the vendors named here to meet state security requirements and protect research data, student records, and grant-funded systems. A technique that any standard user, including a student worker or compromised low-privilege account, can use to blind endpoint protection undermines a core assumption: that once deployed, EDR and MDM agents stay on and keep reporting.
What your institution should do
Confirm with your CrowdStrike and Kandji representatives that your deployed versions include the patches and detections released for this research; if you run a different EDR platform, ask whether your vendor was the unnamed third vendor affected. Treat any unexplained gap in Mac telemetry as a priority investigation, not a routine glitch, since this technique is designed to look normal. Review whether your Mac fleet still needs broad standard-user privileges for common tasks, since trimming unnecessary local access narrows who could attempt this chain. Once XM Cyber's XPC Hunter tool ships after Black Hat, run it against campus Mac images to find other exploitable XPC surfaces first. Finally, configure MDM enrollment reporting to alert on agents that silently stop checking in, not just ones reporting explicit errors.
RSOC monitors developments like this across the higher education sector so Texas institutions do not have to track every vendor advisory alone. If your team wants help assessing exposure, verifying patch status, or building detection for endpoint-tampering behavior, reach out through rsoc.utexas.edu. We are here as a resource for every Texas campus, agency, and college working to keep students, faculty, and research secure.