A path handling issue was addressed with improved validation.

Apple macOS2026-10-26 21:17 UTC1 min readRead in

Summary

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

Remediation

Inventory every Apple macOS deployment, including staging.
Upgrade Apple macOS to the fixed version for your release line, listed under Affected versions.
Confirm the running version after the upgrade.

References

Advisoryhttps://support.apple.com/en-us/149521
Advisoryhttps://support.apple.com/en-us/149522
Advisoryhttps://support.apple.com/en-us/149523

CVSS vector

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <15.8.2	15.8.2
0 – <26.7.2	26.7.2
0 – <27.2	27.2
15.0 – <15.8.2	15.8.2
26.0 – <26.7.2	26.7.2
27.0 – <27.2	27.2

Weakness

CWE-22

Exploit probability (EPSS)

0.2%

Timeline

2026-10-26Publicly disclosed

Sources

NVD · CVE