CVE-2026-86819

Waves Central local privilege escalation via Improper XPC Client Authentication in macOS

Published Sep 8, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.

Analysis

Technical impact

The vulnerability resides in the Waves Central privileged helper service on macOS, which authenticates XPC clients by comparing the caller's code‑signing certificate chain to its own instead of validating against a pinned requirement. A local authenticated user can supply a process signed by the same team ID, pass the helper’s check, and cause the helper to execute a script with root privileges. This flaw allows the attacker to gain root access, enabling full system compromise.

Affected Systems

Vulnerable versions of Waves Central for macOS prior to 17.0, distributed by Waves Audio Ltd. The issue affects the helper component used by the application on all macOS releases before 17.0.

Risk and Exploitability

With a CVSS score of 8.4 the severity is high, though the EPSS score is not available and it is not listed in the CISA KEV catalog. The attack requires local authenticated access, so an insider or an attacker who has logged into the system can exploit it immediately. The high score reflects the ability to obtain root privileges and the potential for widespread impact.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Waves Audio Ltd.

Waves Central

unknown

Version	Status	Constraints
`16.6.2`	affected	< 17.0
`17.0`	unaffected	—

No data.

Vendor Product Versions

Waves Audio

Waves Central

Version	Status	Scheme	Platform
`[16.6.2,17.0)`	affected	semver	—
`17.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Waves Central version 17.0 or later to apply the fix for the helper service authentication check.
If upgrading is delayed, restrict local users from launching the Waves Central privileged helper by removing them from administrative roles or disabling the helper via launchctl until the patch is applied.
Enable Gatekeeper and macOS notarization enforcement so only trusted, notarized applications can run, reducing the chance of executing malicious scripts via the helper.

Generated by OpenCVE AI on September 9, 2026 at 09:38 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.100% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-251-02.json
https://www.cve.org/CVERecord?id=CVE-2026-86819
https://www.waves.com/downloads/release-notes#v17

History

Sep 14, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 5:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Waves Audio Waves Audio waves Central
Vendors & Products		Waves Audio Waves Audio waves Central

Sep 8, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
Title		Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
Weaknesses		CWE-862
References		https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-251-02.json https://www.cve.org/CVERecord?id=CVE-2026-86819 https://www.waves.com/downloads/release-notes#v17
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`