Ubiquiti WiFiman Desktop: Local privilege escalation (CVE-2026-119250)
A local, low-privileged user can exploit an External Control of File Name or Path vulnerability in Ubiquiti WiFiman Desktop for macOS to execute arbitrary commands as root.
CVE search metadata
CVE search record: CVE-2026-119250. Severity: high. CVSS: 7.8. KEV: no. Product: WiFiman Desktop. Brief: Ubiquiti WiFiman Desktop: Local privilege escalation (CVE-2026-119250). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wifiman-privilege-escalation/
Triage facts
Revision 1- Applicability
- WiFiman Desktop
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 21:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Ubiquiti WiFiman Desktop for macOS contains an External Control of File Name or Path vulnerability (CVE-2026-119250). A local attacker with low-privileged access can exploit this flaw to execute arbitrary commands with root privileges. No specific public exploit code or patch status is detailed in the advisory beyond the existence of the vulnerability.
Impact
Successful exploitation allows a local, unprivileged attacker to escalate their privileges to root on the affected macOS host, potentially leading to full system compromise.
Recommendation
Inventory all macOS endpoints running WiFiman Desktop. Restrict local user access to the directory structures associated with the application, or uninstall the software until a security update is provided by the vendor.
Immediate actions
Identify all macOS systems with WiFiman Desktop installed for risk assessment.
Threat Hunt
Monitor for suspicious process execution where the parent is a WiFiman Desktop component but the child is an unexpected system utility or shell.
Data: Endpoint telemetry capturing parent-child process relationships
Mitigations
Remove or isolate WiFiman Desktop on macOS endpoints until Ubiquiti releases a patch.
CVE-2026-119250