7.8
HighCVSS 3.1 · from CISA
CVE-2026-112677
An authorization issue was addressed with improved access control.
macOS · Missing authorization · CWE-862AffectedmacOS
FixUpdate to 15.8.2, 26.7.2, 27.2 or newer
PublishedOct 26, 20:43 · apple
Scored7.8 · CISA
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges.
From apple
Affected and fixed versions
ProductAffectedFixed inmacOSbefore 15.8.215.8.2macOSbefore 26.7.226.7.2macOSbefore 27.227.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known