High severity · published Oct 29, 2026
CVE-2026-119250
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary…
New
7.8
CVSS
–
EPSS
No
On KEV
Description
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
WiFiman Desktop for macOS · Ubiquiti Inc
before 1.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119250
community.ui.com
https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808
More from WiFiman Desktop for macOS
7.5
CVE-2026-119249
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop for macOS to obtain information about the…
6.7
CVE-2026-119251
A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the…