EIP-2026-104601

This exploit leverages a local privilege escalation vulnerability in RsyncX, which fails to drop setgid wheel privileges before executing a third-party binary. By manipulating the PATH environment variable and creating a malicious 'defaults' script, an attacker can execute arbitrary code with group wheel privileges.