CVE-2026-4556

7.8 HIGH 0.9% exploit odds No fix listed Injection

What it is

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.

At a glance

Exploitability: Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.
Exploit odds: 0.9% chance of exploitation in the next 30 days (EPSS).
Fix: No patch or advisory is linked yet. Look at mitigations or restrict exposure.