Is CVE-2026-32323 actively exploited?

No active exploitation of CVE-2026-32323 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32323 be exploited remotely?

No. CVE-2026-32323 requires local access to exploit.

What is the CVSS score of CVE-2026-32323?

CVE-2026-32323 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-32323

HIGH

CVE-2026-32323

CWE-269Published: May 19, 2026· Updated: May 22, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.3th

Official Description

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.

NVD Source

Technical Analysis

CVE-2026-32323 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.