Vulnerability · Published Sep 8, 2026 · Assigned by cisa-cg
CVE-2026-86819Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
High 7.1
In plain English
A high-severity missing authorization in Waves Central from Waves Audio Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Waves Audio Ltd. | Waves Central | 16.6.2 – before 17.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N