Official Statement: X-VPN Has Fixed a Local Privilege Escalation Vulnerability

Intro

Recently, Fluid Attacks reported a local privilege escalation vulnerability (CVE-2026-2638) through responsible disclosure, affecting X-VPN macOS website versions 77.0 through 77.5. We took the report seriously, reproduced the issue internally, and released the fix in X-VPN macOS website version 77.5.1. Our internal review confirmed that the issue was not in X-VPN’s VPN tunnel, encryption protocol, account system, or server infrastructure, and that no other X-VPN platforms or versions outside the affected  macOS website range were impacted. No in-the-wild exploitation has been observed. Users of affected versions should update as soon as possible.

In the spirit of transparency and accountability, we will share the details of the vulnerability, its scope, and the actions we have taken.

Our Key Findings

CVE-2026-2638 is a local privilege escalation vulnerability affecting X-VPN macOS website (the standalone macOS version downloaded from xvpn.io) versions 77.0-77.5. A local privilege escalation issue means that, under specific local conditions, a user or process with limited permissions on the same device could gain administrator-level access. X-VPN has fixed this issue in X-VPN macOS website version 77.5.1 and later.

The vulnerability originated in X-VPN macOS website version’s Download Protection feature (found under Security → Browser Protection → Download Protection), which scans downloaded files, quarantines those that appear unsafe, and restores them on request. Because quarantining and restoring files involves writing to locations protected by macOS system permissions, parts of this feature run with administrator-level permissions. 

CVE-2026-2638 was a flaw in how this administrator-level part of the feature verified file identity across the scan, quarantine, and restore stages, which could allow a malicious local program to redirect a privileged operation to a file other than the one it was meant for. A detailed explanation is provided in What Is CVE-2026-2638.

This was not a remote network attack and did not affect X-VPN’s VPN tunnel, encryption protocol, account system, or server infrastructure. The Mac App Store version of X-VPN and X-VPN for Windows, iOS, Android, Linux, Router, TV, Chrome Extension, Chromebook, and Game Consoles were not affected.

Users running X-VPN macOS website versions 77.0-77.5 should update to version 77.5.1 or later now.

The key facts are summarized below:

What Is CVE-2026-2638?

To explain how CVE-2026-2638 could be exploited, it helps to first look at how Download Protection normally works.

X-VPN macOS website version’s Download Protection feature follows a three-stage process: it scans new download files, quarantines files that look suspicious, and restores them when a restore action is requested. To identify which file it is working on at each stage, the feature tracks the file by its location on the Mac: its file path. The vulnerability stemmed from this: the feature trusted the file path alone to keep pointing to the same file across all three stages, without independently re-verifying the file’s actual content.

In normal use, that is a fair assumption, file paths do not usually change between operations. But under two specific conditions, this assumption could be exploited:

The first condition raises a natural question: where would such a malicious program come from in the first place? This is worth briefly addressing, because the answer also shows what CVE-2026-2638 itself is, and is not, responsible for.

Where The Malicious Program Comes From

A malicious program could end up on a device through any of the usual means, for example, opening a phishing email, downloading and running software from an untrusted source, or installing a compromised third-party application. These initial infection paths are independent of CVE-2026-2638 itself.

On macOS, programs normally run with the permissions of the user who launched them. A malicious program installed through these channels would therefore start with only regular user permissions, it could not, on its own, modify protected system locations or take administrator-level actions. Gaining administrator-level access typically requires the user to explicitly authorize it (such as through a password prompt). This is why local privilege escalation vulnerabilities matter: they offer attackers a way around this barrier.

The Two Gaps That Made The Attack Possible

The vulnerability was that Download Protection did not check whether the file it was about to handle was actually a shortcut to somewhere else. A malicious program could plant such a shortcut where Download Protection was about to act, and have it point to an important file elsewhere on the system. Download Protection, which runs with administrator-level permissions, would then unknowingly perform its operation on that file instead, even though that file was never meant to be touched.

Why This Resulted In Privilege Escalation

In both cases, the malicious program itself did not directly gain new permissions. What it did was redirect a legitimate privileged operation, performed by Download Protection, to a file that the malicious program would otherwise have no ability to modify. By tricking Download Protection into writing to a system-protected location on its behalf, the malicious program could indirectly cause changes that only administrator-level processes are normally allowed to make.

This is what made CVE-2026-2638 a local privilege escalation: not by stealing administrator-level access, but by tricking a legitimate administrator-level operation into doing something it was never meant to do.

In practice, this means the malicious program could make changes to the device’s system-level behavior that should require administrator authorization.

What CVE-2026-2638 Is Not

• Not a breach of X-VPN servers
• Not a vulnerability in the VPN tunnel, encryption protocol, account system, or server infrastructure
• Not a remote attack, it requires local low-privilege access to the device
• Not applicable to other platforms or to the App Store version

How We Fixed It

X-VPN macOS website version 77.5.1 strengthens the download protection file restoration workflow. The main improvements include:

1. File Identity Consistency Checks

When a downloaded file is scanned by the protection layer, the file’s content fingerprint is now recorded. If the file later needs to be quarantined, X-VPN re-verifies whether the current file content still matches what was scanned.

If the file has been replaced, modified, or otherwise changed after scanning, the quarantine process is rejected.

2. Quarantine Integrity Validation

After a file enters quarantine, integrity information about its quarantined state is recorded. Before a user restores the file, X-VPN re-verifies that the quarantined file is still in its recorded quarantine state.

If the quarantined file has been replaced or modified, the restore operation is blocked.

3. Symbolic-Links Are Not Accepted in Critical Operations

The download protection workflow now refuses to scan or restore symbolic-link files. This prevents attackers from redirecting quarantine or restore operations to unintended files via path manipulation.

Overall, this fix no longer relies only on file paths to identify the file being operated on. Instead, X-VPN now uses multi-stage content integrity checks to verify that files have not been replaced or modified during the scan, quarantine, and restore stages. It also blocks symbolic-link redirection that could otherwise cause privileged restore operations to apply to unintended file locations.

Understanding the Severity

CVE-2026-2638 was rated with a CVSS v4.0 base score of 7.3 (High), with the vector string:

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS (Common Vulnerability Scoring System) is the industry-standard framework for rating the severity of security vulnerabilities. According to FIRST, the organization that maintains the CVSS standard, CVSS measures how serious a vulnerability could be if successfully exploited, not how likely that exploitation actually is in practice. A “High” rating therefore reflects how much damage the vulnerability could cause under successful exploitation, not a prediction of how likely it is to be exploited against real users. 

The vector string above breaks down the score into multiple dimensions, such as where the attack must originate from, what conditions must be met to exploit it, and how seriously a successful attack could affect the system.

In practice, two attributes of the vector explain why exploiting CVE-2026-2638 is far from straightforward:

• AV:L (Attack Vector: Local). Exploitation requires local access to the device. The vulnerability cannot be triggered remotely over the internet.
• AT:P (Attack Requirements: Present). Specific conditions must be met for the attack to succeed, including the ability to interact with the affected download protection file restoration workflow and manipulate file handling within a narrow timing window.

Therefore, CVE-2026-2638 should be taken seriously, and users of affected macOS website versions should update to X-VPN macOS website version 77.5.1 or later. However, because exploitation requires local access and specific conditions, it does not place X-VPN users at immediate, broad-scale remote risk.

Affected Scope

The table below summarizes which X-VPN versions are affected by CVE-2026-2638:

Recommendations for Users

Update To The Latest Version Immediately

To check your current version:

1. Open the X-VPN app on your MacBook.
2. Click Settings in the bottom-left corner.
3. Click About X-VPN.
4. Your current version is shown under “X-VPN for Mac”.

If your version is between 77.0 and 77.5, update by downloading the latest version from our Mac Download page.

Next Steps & Contact

X-VPN remains committed to user security beyond this specific issue. As part of our ongoing security practices.

• Continuous code audits and vulnerability scans: We regularly review our codebase and run security checks to identify and address potential issues before they reach users.

• Bug Bounty Program: We welcome security researchers to submit responsible vulnerability reports through our Bug Bounty Program. Valid and reproducible findings are eligible for monetary rewards, helping us strengthen the security of every X-VPN client.

• Direct reporting channel: If you discover a security concern or suspect unusual behavior in X-VPN, please email security@xvpn.io. All reports are reviewed by our security team.

We thank Fluid Attacks for responsibly disclosing CVE-2026-2638 and for working with us through the coordinated disclosure process.

FAQs