CVE-2026-2638 HIGH

CVE-2026-2638: X-VPN macOS website versions - Local Privilege Escalation

Vendor X-Vpn
Product X-VPN macOS website
Weakness CWE-367
Published June 9, 2026
Last update June 9, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.

Key dates

02Disclosure timeline

June 9, 2026 CVE published
June 9, 2026 Record updated