CVE-2026-86819

Waves Central for macOS ships a privileged helper service that fails to properly authorize XPC clients (CWE-862): instead of validating callers against a pinned code requirement (application identifier and Team ID), it simply compares the caller's code-signing certificate chain for equality with its own. A local, authenticated user can execute code inside a process signed with the vendor's certificate, thereby satisfying the helper's flawed client check. The attacker can then cause the helper to execute a script with root privileges, gaining full root access on the local machine. Any macOS user running Waves Central prior to version 17.0 is affected; exploitation requires local access and there is no evidence of exploitation in the wild, no public proof-of-concept, and EPSS places 30-day exploitation probability at 0.1%.

What to do: Upgrade Waves Central on all macOS systems to version 17.0 or later, which pins the helper's client validation to the vendor's application identifier and Team ID. Check installed versions on shared or multi-user Macs (studios, labs, production machines), since any local account can trigger the flaw; until patched, restrict local access to sensitive workstations. No internet-facing exposure is involved, so this is a local endpoint-hardening issue rather than a perimeter concern.