Mullvad VPN macOS Installer Flaw Allows Root Code Execution
The National Vulnerability Database (NVD) has detailed CVE-2026-32323, a high-severity vulnerability (CVSS 7.3) affecting Mullvad VPN’s macOS client, versions 2026.1 and below. This local privilege escalation flaw arises during installation or upgrade processes where the installer package executes binaries from the /Applications/Mullvad VPN.app directory. Crucially, it fails to verify if the application bundle is legitimate or attacker-controlled.
An attacker with administrative group access could pre-place a malicious application bundle at this location. When a user initiates an install or upgrade, the legitimate installer would then execute the attacker’s crafted binaries, achieving code execution with root privileges. This grants a local attacker full control over the system, bypassing critical security controls.
Mullvad VPN has addressed this issue in version 2026.2-beta1. The NVD notes that existing users running older versions are not immediately at risk from this specific installer vulnerability unless they attempt to install or upgrade. However, the vector itself highlights a critical weakness in application deployment hygiene, a common blind spot for many organizations.
What This Means For You
- If your organization uses Mullvad VPN on macOS, particularly with local admin users, you need to ensure all installations and upgrades are handled with the utmost care. This isn't just about Mullvad; it's a stark reminder that even trusted application installers can be weaponized if their integrity checks are weak. Audit your software deployment pipelines. An admin-level attacker gaining root is game over.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-32323 - Mullvad VPN Installer Privilege Escalation via Crafted Bundle
title: CVE-2026-32323 - Mullvad VPN Installer Privilege Escalation via Crafted Bundle
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
Detects the Mullvad VPN installer attempting to execute a binary from the expected application path, which could be a malicious binary placed by an attacker to achieve root code execution. This rule specifically targets the known vulnerability CVE-2026-32323 where the installer does not properly verify the integrity of the application bundle at /Applications/Mullvad VPN.app.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-32323/
tags:
- attack.privilege_escalation
- attack.t1547.001
logsource:
category: process_creation
detection:
selection:
Image|endswith:
- '/Mullvad VPN.app/Contents/MacOS/Mullvad VPN'
ParentImage|endswith:
- '/Mullvad VPN.app/Contents/MacOS/Mullvad VPN'
CommandLine|contains:
- 'install'
- 'upgrade'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-32323 | Privilege Escalation | Mullvad VPN client app for macOS |
| CVE-2026-32323 | Privilege Escalation | Mullvad VPN macOS versions 2026.1 and below |
| CVE-2026-32323 | Privilege Escalation | Vulnerable component: Installer package executing binaries from /Applications/Mullvad VPN.app without path verification |
| CVE-2026-32323 | Privilege Escalation | Fixed in Mullvad VPN macOS version 2026.2-beta1 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 19, 2026 at 05:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...