A race condition was addressed with additional validation.

Apple macOS2026-10-26 20:39 UTC1 min readRead in

AR EN

Summary

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

Remediation

Inventory every Apple macOS deployment, including staging.
Upgrade Apple macOS to the fixed version for your release line, listed under Affected versions.
Confirm the running version after the upgrade.

References

Advisoryhttps://support.apple.com/en-us/149521
Advisoryhttps://support.apple.com/en-us/149522
Advisoryhttps://support.apple.com/en-us/149523

CVSS vector

Attack vector: Local
Complexity: High
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <15.8.2	15.8.2
0 – <26.7.2	26.7.2
0 – <27.2	27.2
15.0 – <15.8.2	15.8.2
26.0 – <26.7.2	26.7.2
27.0 – <27.2	27.2

Weakness

CWE-362

Exploit probability (EPSS)

0.1%

Timeline

2026-10-26Publicly disclosed

Sources

CVE · NVD