CVE-2026-24063

When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.

• CWE-276

• https://r.sec-consult.com/arturia

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24056pnpm is a package manager. Prior to version 10.28.2, when pn…6.5
• CVE-2026-24058Soft Serve is a self-hostable Git server for the command lin…9.8
• CVE-2026-2406Authorization bypass through User-Controlled key vulnerabili…6.5
• CVE-2026-24060Service information is not encrypted when transmitted as BAC…9.1
• CVE-2026-24061telnetd in GNU Inetutils through 2.7 allows remote authentic…9.8
• CVE-2026-24062The "Privileged Helper" component of the Arturia Software Ce…7.8
• CVE-2026-24064Waves Central for macOS versions 13.0.9 through 16.5.5 conta…7.8
• CVE-2026-24065Waves Central for macOS versions 13.0.9 through 16.5.5 conta…8.1
• CVE-2026-24066Slate Digital Connect 1.37.0 for macOS installs a privileged…8.4
• CVE-2026-24067Slate Digital Connect 1.37.0 for macOS installs a privileged…8.4
• CVE-2026-24068The VSL privileged helper does utilize NSXPC for IPC. The im…8.8
• CVE-2026-24069Kiuwan SAST improperly authorizes SSO logins for locally dis…5.4