Vulnerability · Published Sep 28, 2026 · Assigned by Pentraze

CVE-2026-4556macOS Exam4 Local Privilege Escalation via Command Injection

High 7.8

In plain English

A high-severity OS command injection in Exam4 from Extegrity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.9%top 40.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.

Affected products (as reported)

Vendor	Product	Versions
Extegrity	Exam4	0 – through 25.12.28.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://pentraze.com/vulnerability-reports