Foxit PDF Editor macOS Installer Privilege Escalation Flaw

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-91800 represents a critical local privilege escalation vulnerability in Foxit PDF Editor's macOS installer that stems from insufficient validation of user-modifiable configuration values during high-privilege upgrade operations. This vulnerability has a CVSS score of 8.8, placing it in the high-severity category. Any local attacker with access to a system running Foxit PDF Editor can exploit this weakness to execute arbitrary commands with root privileges, effectively gaining complete system control. Organizations and individual users relying on Foxit for PDF editing—particularly in regulated industries handling sensitive documents—face significant risk if their systems remain unpatched.

Casky's 224 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) techniques embedded in this vulnerability. Practitioners using Casky would identify suspicious installer behavior through detection of CWE-732 (Incorrect Permission Assignment) patterns, such as monitoring for configuration file modifications in installer directories, unexpected permission changes on upgrade processes, and unauthorized elevation of process privileges during software maintenance. The platform's skill set enables security teams to correlate installer execution patterns, configuration access anomalies, and privilege boundary violations—surfacing indicators that a local attacker is attempting to manipulate installer logic to gain root-level code execution. By mapping these observations against MITRE ATT&CK's privilege escalation techniques, Casky helps practitioners distinguish legitimate upgrade operations from exploitation attempts and prioritize remediation efforts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-91800.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-91800

Casky has 224 skills that investigate the attack patterns behind CVE-2026-91800. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn