Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-09 | 1 | Disclosure1 |
| 2026-07-14 | 1 | Disclosure1 |
| 2026-07-15 | 1 | Patch1 |
| 2026-07-21 | 1 | Disclosure1 |
We believe accountability starts with transparency, so we’ve shared the full scope of CVE-2026-2638 and the steps we took to address it in our official statement: https://xvpn.io/resources/statement-local-privilege-escalation-vulnerability
Post summary
The company has publicly disclosed the details of CVE-2026‑2638 and announced remediation steps. No exploits, PoCs, or active exploitation reports are referenced.
Fluid Attacks' research team found a zero-day vulnerability in X-VPN macOS website versions. As a #CNA, we assigned the ID CVE-2026-2638. Details here: 🔗 https://fluidattacks.com/advisories/soad. We have disclosed 258 #CVE to this date: 🔗https://fluidattacks.com/advisories/. https://t.co/aGJClkubjM
Post summary
The tweet announces the discovery of a zero‑day CVE-2026-2638 in X‑VPN macOS website versions, provides a link to an advisory, but gives no proof of concept, exploit code, or patch information.
Fluid Attacks' research team found a zero-day vulnerability in X-VPN macOS website versions. As a #CNA, we assigned the ID CVE-2026-2638. Details here: 🔗 https://fluidattacks.com/advisories/soad. We have disclosed 259 #CVE to this date: 🔗https://fluidattacks.com/advisories/. https://t.co/lwSIyuPCPs
Post summary
Fluid Attacks announced discovery of a zero‑day vulnerability in X‑VPN macOS website versions, assigned CVE‑2026‑2638, and provided an advisory link for details.
CVE-2026-2638 A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and sym… https://www.cve.org/CVERecord?id=CVE-2026-2638
Post summary
The post announces CVE-2026-2638, a race condition in X‑VPN macOS versions 77.0‑77.5 that permits local attackers to exploit the quarantine and restore workflow; no proof‑of‑concept, exploit, patch, or active exploitation details are provided.