PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24066 Slate Digital LLC CVE debrief

CVE-2026-24066 is a HIGH-severity vulnerability in Slate Digital Connect 1.37.0 for macOS. The vulnerability is caused by a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes an XPC service that can be accessed by a local attacker using a self-signed certificate with a specific organizational unit value. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation.

Vendor
Slate Digital LLC
Product
Slate Digital Connect
CVSS
HIGH 8.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-10
Original CVE updated
2026-06-10
Advisory published
2026-06-10
Advisory updated
2026-06-10

Who should care

Users of Slate Digital Connect 1.37.0 for macOS should apply the necessary patches to prevent local privilege escalation.

Technical summary

The Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing authority.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches or updates provided by the vendor to fix the vulnerability.
  • Use secure coding practices to verify the certificate chain to a trusted code-signing authority.

Evidence notes

The vulnerability was reported by Sec Consult.

Official resources

CVE-2026-24066 was published on 2026-06-10T12:16:25.223Z and modified on 2026-06-10T20:12:28.193Z.