CVE-2026-86819: Waves Audio Ltd Waves Central

High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days.

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0.

Affected products

Published 2026-09-08. Last modified 2026-09-14.