{"vulnerability": "CVE-2022-26706", "sightings": [{"uuid": "bc714647-d3bd-4d92-a711-fc9dc4be8f33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/BleepingComputer/12735", "content": "Latest news and stories from BleepingComputer.com\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nOn macOS systems that don't have Apple's recent security updates, a vulnerability identified as CVE-2022-26706 could help an attacker bypass sandbox restrictions to execute code with elevated privileges. [...]", "creation_timestamp": "2022-07-13T20:50:48.000000Z"}, {"uuid": "a357089b-50eb-4315-9837-f60cb39781cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/BleepingComputer/12747", "content": "Latest news and stories from BleepingComputer.com\nMicrosoft releases PoC exploit for macOS sandbox escape vulnerability\n\nOn macOS systems that don't have Apple's recent security updates, a vulnerability identified as CVE-2022-26706 could help an attacker bypass sandbox restrictions to execute code with elevated privileges. [...]", "creation_timestamp": "2022-07-14T16:54:09.000000Z"}, {"uuid": "4ee787e3-2d4c-4188-ba64-6247937bef13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/BleepingComputer/12736", "content": "Microsoft releases tweet-size exploit for macOS sandbox escape bug\n\nOn macOS systems that don't have Apple's recent security updates, a vulnerability identified as CVE-2022-26706 could help an attacker bypass sandbox restrictions to execute code with elevated privileges. [...]\n\nhttps://www.bleepingcomputer.com/news/security/microsoft-releases-tweet-size-exploit-for-macos-sandbox-escape-bug/", "creation_timestamp": "2022-07-13T21:19:03.000000Z"}, {"uuid": "b1028ee5-3058-4e3c-8137-d82cd8510400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/itsec_news/1008", "content": "\u200b\ud83d\udcbb \u0412 macOS \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0442\u0432\u0438\u0442-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442.\n\n\ud83d\udcac Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 macOS. \u041e\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2022-26706 \u0438 \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u043b\u0430, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f macOS, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043c\u0430\u043a\u0440\u043e\u043a\u043e\u0434\u0443 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Word \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u00ab\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043d\u0430\u043b\u0430\u0433\u0430\u0435\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439\u00bb, \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435\u00bb, \u2014 \u043d\u0430\u043f\u0438\u0441\u0430\u043b\u0430 Microsoft \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n\u0414\u0436\u043e\u043d\u0430\u0442\u0430\u043d \u0411\u0430\u0440 \u041e\u0440 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b Microsoft 365 Defender \u043e\u0431\u044a\u044f\u0441\u043d\u0438\u043b, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043f\u0440\u0438 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043c\u0430\u043a\u0440\u043e\u0441\u043e\u0432 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Microsoft Office \u043d\u0430 macOS.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u043c \u043e\u0442\u0447\u0435\u0442\u0430\u043c, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u00abopen \u2013stdin\u00bb \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 macOS \u0438 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0410 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u00ab-stdin\u00bb \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 \u00abcom.apple.quarantine\u00bb .\n\n\u00abPython \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u0430\u0448 \u043a\u043e\u0434, \u0430 \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u043e \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u043f\u0443\u0441\u043a\u0430, \u043e\u043d \u043d\u0435 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d \u043a \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b Word\u00bb, \u2014 \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442 \u0414\u0436\u043e\u043d\u0430\u0442\u0430\u043d \u041e\u0440 \u0411\u0430\u0440.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u0430\u0436\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0436\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0439 \u0432\u044b\u0448\u0435 \u043a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e, \u0447\u0442\u043e \u043e\u043d \u043f\u043e\u043c\u0435\u0441\u0442\u0438\u043b\u0441\u044f \u0432 \u0440\u0430\u0437\u043c\u0435\u0440 \u0442\u0432\u0438\u0442\u0430. Microsoft \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 Apple \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430, \u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 macOS \u0432 \u043c\u0430\u0435 2022 \u0433\u043e\u0434\u0430 (Big Sur 11.6.6). \u041d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0410\u0440\u0441\u0435\u043d\u0438\u0439 \u041a\u043e\u0441\u0442\u0440\u043e\u043c\u0438\u043d \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0440\u0430\u043d\u044c\u0448\u0435.\n\n#macOS #\u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 #Microsoft #Apple\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-07-15T13:58:09.000000Z"}, {"uuid": "4a8e12f0-7a30-409f-8a6e-b88ff659e305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/55357", "content": "Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706\n\nhttps://ift.tt/i6KPUr8", "creation_timestamp": "2022-07-13T18:11:34.000000Z"}, {"uuid": "3fe2c6fd-241c-420d-b4e8-0f3d4c7a2f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/arpsyndicate/105", "content": "#ExploitObserverAlert\n\nCVE-2022-26706\n\nDESCRIPTION: Exploit Observer has 10 entries related to CVE-2022-26706. An access issue was addressed with additional sandbox restrictions on third-party applications. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.\n\nFIRST-EPSS: 0.000730000\nNVD-IS: 3.6\nNVD-ES: 1.8", "creation_timestamp": "2023-11-12T02:29:52.000000Z"}, {"uuid": "8aad7179-8f4a-4c42-bcfa-1c3301249c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/3174", "content": "\u034fMicrosoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 PoC \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0441 \u0442\u0432\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 Microsoft \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 Apple \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 macOS \u0432 \u043c\u0430\u0435 2022 \u0433\u043e\u0434\u0430 (Big Sur 11.6.6).\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 CVE-2022-26706, \u043f\u043e\u044f\u0441\u043d\u0438\u0432, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f macOS, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043c\u0430\u043a\u0440\u043e\u043a\u043e\u0434\u0443 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Word \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043c\u0430\u043a\u0440\u043e\u0441\u0430\u043c\u0438 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Office \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u043e\u0439 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c Windows. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c macOS.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0440\u0438 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043c\u0430\u043a\u0440\u043e\u0441\u043e\u0432 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Office \u043d\u0430 macOS.\n\n\u0418\u0437\u0443\u0447\u0438\u0432 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u043e\u0442\u0447\u0435\u0442\u044b (1, 2) \u043e \u0432\u044b\u0445\u043e\u0434\u0435 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b macOS, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0433\u0440\u0443\u043f\u043f\u044b Microsoft 365 Defender \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 Launch Services \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u00a0\u043a\u043e\u043c\u0430\u043d\u0434\u044b\u00a0open \u2013stdin\u00a0\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0444\u0430\u0439\u043b\u0435 Python \u0441 \u0432\u044b\u0448\u0435\u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c \u00ab~$\u00bb \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 macOS.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 PoC c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00a0\u043e\u043f\u0446\u0438\u0438\u00a0-stdin \u0434\u043b\u044f\u00a0\u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f\u00a0\u0444\u0430\u0439\u043b\u0430 Python, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 com.apple.quarantine.\n\n\u041a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u0430\u0436\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0436\u0430\u0442\u044c \u0435\u0433\u043e \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e, \u0447\u0442\u043e \u043e\u043d \u043f\u043e\u043c\u0435\u0441\u0442\u0438\u043b\u0441\u044f \u0432 \u0442\u0432\u0438\u0442, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0438\u0436\u0435 \ud83d\udc47", "creation_timestamp": "2022-07-14T15:44:23.000000Z"}, {"uuid": "7db3794a-3643-4472-90cf-9814c50f2f41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/thehackernews/2369", "content": "Microsoft has disclosed details of a now-patched vulnerability (CVE-2022-26706) in Apple operating systems \u2014 iOS, iPadOS, macOS, tvOS and watchOS \u2014 that could allow attackers to escalate privileges and deploy malware.\n\nRead: https://thehackernews.com/2022/07/microsoft-details-app-sandbox-escape.html", "creation_timestamp": "2022-10-19T12:14:46.000000Z"}, {"uuid": "310fc5f7-dcf8-4e8a-a1a3-aed6a3eaf312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/xakep_ru/12635", "content": "Microsoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u0434\u043b\u044f \u043f\u043e\u0431\u0435\u0433\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b macOS\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0430 \u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Apple. \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u044d\u0442\u043e\u0442 \u0431\u0430\u0433 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043a\u0438\u043d\u0443\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443, \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e.\n\nhttps://xakep.ru/2022/07/14/cve-2022-26706-poc/", "creation_timestamp": "2022-07-14T22:04:41.000000Z"}, {"uuid": "6c0980c4-c773-4664-bf23-5d0015734c87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "exploited", "source": "https://t.me/S_E_Reborn/2472", "content": "\u034fMicrosoft \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 PoC \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c \u0441 \u0442\u0432\u0438\u0442 \u0434\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043c\u043e\u0447\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u041e\u0431 \u043e\u0448\u0438\u0431\u043a\u0435 Microsoft \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 Apple \u0432 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430, \u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 macOS \u0432 \u043c\u0430\u0435 2022 \u0433\u043e\u0434\u0430 (Big Sur 11.6.6).\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 CVE-2022-26706, \u043f\u043e\u044f\u0441\u043d\u0438\u0432, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f macOS, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043c\u0430\u043a\u0440\u043e\u043a\u043e\u0434\u0443 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Word \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435.\n\n\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043c\u0430\u043a\u0440\u043e\u0441\u0430\u043c\u0438 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Office \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0439 \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u043e\u0439 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0438\u0441\u0442\u0435\u043c Windows. \u041a\u0430\u043a \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u0442\u043e \u0436\u0435 \u0441\u0430\u043c\u043e\u0435 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c macOS.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043f\u0440\u0438 \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043c\u0430\u043a\u0440\u043e\u0441\u043e\u0432 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0445 Office \u043d\u0430 macOS.\n\n\u0418\u0437\u0443\u0447\u0438\u0432 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u043e\u0442\u0447\u0435\u0442\u044b (1, 2) \u043e \u0432\u044b\u0445\u043e\u0434\u0435 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b macOS, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0433\u0440\u0443\u043f\u043f\u044b Microsoft 365 Defender \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 Launch Services \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u00a0\u043a\u043e\u043c\u0430\u043d\u0434\u044b\u00a0open \u2013stdin\u00a0\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0444\u0430\u0439\u043b\u0435 Python \u0441 \u0432\u044b\u0448\u0435\u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u043c \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u043e\u043c \u00ab~$\u00bb \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0432 macOS.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 PoC c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c\u00a0\u043e\u043f\u0446\u0438\u0438\u00a0-stdin \u0434\u043b\u044f\u00a0\u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f\u00a0\u0444\u0430\u0439\u043b\u0430 Python, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 com.apple.quarantine.\n\n\u041a\u043e\u0434 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0434\u0430\u0436\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0436\u0430\u0442\u044c \u0435\u0433\u043e \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e, \u0447\u0442\u043e \u043e\u043d \u043f\u043e\u043c\u0435\u0441\u0442\u0438\u043b\u0441\u044f \u0432 \u0442\u0432\u0438\u0442, \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0432\u0438\u0434\u0435\u0442\u044c \u043d\u0438\u0436\u0435 \ud83d\udc47", "creation_timestamp": "2022-09-25T16:45:01.000000Z"}, {"uuid": "e790db6d-6b11-43df-b1c8-f61a33e15b6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6398", "content": "#exploit\n1. Uncovering a macOS App Sandbox escape vulnerability: A deep dive into CVE-2022-26706\nhttps://www.microsoft.com/security/blog/2022/07/13/uncovering-a-macos-app-sandbox-escape-vulnerability-a-deep-dive-into-cve-2022-26706\n\n2. CVE-2022-23631:\nRCE via Prototype Pollution in Blitz.js\nhttps://blog.sonarsource.com/blitzjs-prototype-pollution", "creation_timestamp": "2022-07-14T13:07:20.000000Z"}, {"uuid": "9df36b98-605b-4e75-ac84-a44aa8d1a5fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "creation_timestamp": "2026-09-01T20:01:12.704159Z"}, {"uuid": "3a94d9c8-7217-4438-8de9-7702457c77f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/61398", "content": "Black Hat Ethical Hacking\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nMicrosoft releases tweet-size exploit for macOS sandbox escape bugPost Views: 22 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has published the exploit code for a vulnerability in macOS\u00a0that\u00a0could help an attacker bypass sandbox restrictions and run code on the system.\n\nThe company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how\u00a0the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.\n\nAbusing macros in Office documents to deploy malware has long been an efficient and popular technique to compromise Windows systems.\n\nThe same could be achieved on macOS machines lacking the proper security updates, Microsoft warns in a report today.\n\u201cDespite the security restrictions imposed by the App Sandbox\u2019s rules on applications, it\u2019s possible for attackers to bypass the said rules and let malicious codes \u201cescape\u201d the sandbox and execute arbitrary commands on an affected device\u201d \u2013 Microsoft\nJonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS.\n\nTo ensure backward compatibility, Microsoft Word can read and write files that come with the prefix \u201c~$,\u201d which is defined in the app\u2019s sandbox rules. \nhttps://www.bleepstatic.com/images/news/u/1100723/2022/MSWord-sandbox-rule.png \nExploit code in a tweetAfter studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open \u2013stdin\u00a0command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.\n\nThe researchers came up with a proof-of-concept (PoC) that used the -stdin\u00a0option for the open\u00a0Command on a Python file to bypass the \u201ccom.apple.quarantine\u201d\u00a0extended attribute restriction.\n\nThe demo exploit code is as simple as dropping a Python file that contains arbitrary commands and has in its name the special prefix for Word.\n\nUsing the open -stdin\u00a0command starts the Python app with the specially crafted file as the standard input.\n\n\u201cPython happily runs our code, and since it\u2019s a child process of launchd, it isn\u2019t bound to Word\u2019s sandbox rules,\u201d Jonathan Or Bar explains.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/macOS_SBX_Microsoft.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:34.701962Z"}, {"uuid": "fe740db9-7925-4df0-b6ae-fafc3fcee884", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "creation_timestamp": "2026-09-02T01:01:29.383587Z"}, {"uuid": "61faa56b-9bcd-446d-8051-fbfd390fc5f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/61398", "content": "Black Hat Ethical Hacking\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nMicrosoft releases tweet-size exploit for macOS sandbox escape bugPost Views: 22 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has published the exploit code for a vulnerability in macOS\u00a0that\u00a0could help an attacker bypass sandbox restrictions and run code on the system.\n\nThe company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how\u00a0the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.\n\nAbusing macros in Office documents to deploy malware has long been an efficient and popular technique to compromise Windows systems.\n\nThe same could be achieved on macOS machines lacking the proper security updates, Microsoft warns in a report today.\n\u201cDespite the security restrictions imposed by the App Sandbox\u2019s rules on applications, it\u2019s possible for attackers to bypass the said rules and let malicious codes \u201cescape\u201d the sandbox and execute arbitrary commands on an affected device\u201d \u2013 Microsoft\nJonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS.\n\nTo ensure backward compatibility, Microsoft Word can read and write files that come with the prefix \u201c~$,\u201d which is defined in the app\u2019s sandbox rules. \nhttps://www.bleepstatic.com/images/news/u/1100723/2022/MSWord-sandbox-rule.png \nExploit code in a tweetAfter studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open \u2013stdin\u00a0command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.\n\nThe researchers came up with a proof-of-concept (PoC) that used the -stdin\u00a0option for the open\u00a0Command on a Python file to bypass the \u201ccom.apple.quarantine\u201d\u00a0extended attribute restriction.\n\nThe demo exploit code is as simple as dropping a Python file that contains arbitrary commands and has in its name the special prefix for Word.\n\nUsing the open -stdin\u00a0command starts the Python app with the specially crafted file as the standard input.\n\n\u201cPython happily runs our code, and since it\u2019s a child process of launchd, it isn\u2019t bound to Word\u2019s sandbox rules,\u201d Jonathan Or Bar explains.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/macOS_SBX_Microsoft.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:44.433637Z"}, {"uuid": "d789b122-9b5f-4a6f-bb70-6090010a25b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "creation_timestamp": "2026-09-05T02:00:05.395829Z"}, {"uuid": "ca73f18d-4612-44f7-b093-5043fd13ef7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/61398", "content": "Black Hat Ethical Hacking\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nMicrosoft releases tweet-size exploit for macOS sandbox escape bugPost Views: 22 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has published the exploit code for a vulnerability in macOS\u00a0that\u00a0could help an attacker bypass sandbox restrictions and run code on the system.\n\nThe company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how\u00a0the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.\n\nAbusing macros in Office documents to deploy malware has long been an efficient and popular technique to compromise Windows systems.\n\nThe same could be achieved on macOS machines lacking the proper security updates, Microsoft warns in a report today.\n\u201cDespite the security restrictions imposed by the App Sandbox\u2019s rules on applications, it\u2019s possible for attackers to bypass the said rules and let malicious codes \u201cescape\u201d the sandbox and execute arbitrary commands on an affected device\u201d \u2013 Microsoft\nJonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS.\n\nTo ensure backward compatibility, Microsoft Word can read and write files that come with the prefix \u201c~$,\u201d which is defined in the app\u2019s sandbox rules. \nhttps://www.bleepstatic.com/images/news/u/1100723/2022/MSWord-sandbox-rule.png \nExploit code in a tweetAfter studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open \u2013stdin\u00a0command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.\n\nThe researchers came up with a proof-of-concept (PoC) that used the -stdin\u00a0option for the open\u00a0Command on a Python file to bypass the \u201ccom.apple.quarantine\u201d\u00a0extended attribute restriction.\n\nThe demo exploit code is as simple as dropping a Python file that contains arbitrary commands and has in its name the special prefix for Word.\n\nUsing the open -stdin\u00a0command starts the Python app with the specially crafted file as the standard input.\n\n\u201cPython happily runs our code, and since it\u2019s a child process of launchd, it isn\u2019t bound to Word\u2019s sandbox rules,\u201d Jonathan Or Bar explains.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/macOS_SBX_Microsoft.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T15:00:06.448253Z"}, {"uuid": "e7ea2155-5977-48e3-b38b-3b39fb9608c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "creation_timestamp": "2026-09-06T00:01:01.697605Z"}, {"uuid": "2411bea9-41ae-4f37-bf0d-99c298d25231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/61398", "content": "Black Hat Ethical Hacking\nMicrosoft releases tweet-size exploit for macOS sandbox escape bug\n\nMicrosoft releases tweet-size exploit for macOS sandbox escape bugPost Views: 22 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nMicrosoft has published the exploit code for a vulnerability in macOS\u00a0that\u00a0could help an attacker bypass sandbox restrictions and run code on the system.\n\nThe company released the technical details for the security issue, which is currently identified as CVE-2022-26706, and explained how\u00a0the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine.\n\nAbusing macros in Office documents to deploy malware has long been an efficient and popular technique to compromise Windows systems.\n\nThe same could be achieved on macOS machines lacking the proper security updates, Microsoft warns in a report today.\n\u201cDespite the security restrictions imposed by the App Sandbox\u2019s rules on applications, it\u2019s possible for attackers to bypass the said rules and let malicious codes \u201cescape\u201d the sandbox and execute arbitrary commands on an affected device\u201d \u2013 Microsoft\nJonathan Bar Or of the Microsoft 365 Defender Research Team explains that the vulnerability was discovered while looking into methods to run and detect malicious macros in Microsoft Office documents on macOS.\n\nTo ensure backward compatibility, Microsoft Word can read and write files that come with the prefix \u201c~$,\u201d which is defined in the app\u2019s sandbox rules. \nhttps://www.bleepstatic.com/images/news/u/1100723/2022/MSWord-sandbox-rule.png \nExploit code in a tweetAfter studying older reports [1, 2] about escaping the macOS sandbox, the researchers found that using Launch Services to run an open \u2013stdin\u00a0command on a special Python file with the abovementioned prefix allows escaping the App Sandbox on macOS, potentially leading to compromising the system.\n\nThe researchers came up with a proof-of-concept (PoC) that used the -stdin\u00a0option for the open\u00a0Command on a Python file to bypass the \u201ccom.apple.quarantine\u201d\u00a0extended attribute restriction.\n\nThe demo exploit code is as simple as dropping a Python file that contains arbitrary commands and has in its name the special prefix for Word.\n\nUsing the open -stdin\u00a0command starts the Python app with the specially crafted file as the standard input.\n\n\u201cPython happily runs our code, and since it\u2019s a child process of launchd, it isn\u2019t bound to Word\u2019s sandbox rules,\u201d Jonathan Or Bar explains.\nhttps://www.bleepstatic.com/images/news/u/1100723/2022/macOS_SBX_Microsoft.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:43.719744Z"}]}