Apple macOS: Improper authentication leading to code execution
Summary
Apple macOS contains an authentication weakness (CWE-287) that Apple fixed in macOS Golden Gate 27.2. According to the NVD record, a remote attacker without privileges and without user interaction could cause arbitrary code execution, although the attack complexity is rated high. The affected component is not identified in the available sources, and Apple's description is generic.
Affected
- macOS Golden Gate versions before 27.2 (per Apple CNA record)
- Tahoe 26.x and Sequoia 15.x: Unknown
Fixed in
- macOS Golden Gate 27.2 (released October 26, 2026)
- Tahoe 26.7.2 and Sequoia 15.8.2: Unknown whether these updates contain the fix
Workaround
Unknown. No workaround is documented; install the update.
Exploitation
- Apple has not published exploitation details.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof-of-concept found. CISA KEV listing not verified.
Our recommendation
- Patch managed Macs to macOS Golden Gate 27.2 via MDM or Software Update, prioritising devices with network exposure.
- Confirm the fixes for Tahoe and Sequoia devices that remain on those branches.
- Check the Apple advisory for the affected component before finalising the risk rating.
- Monitor for exploitation reports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of macOS Golden Gate 27.2 support.apple.com
- OpenCVE CVE-2026-112427 app.opencve.io
- Strix CVE-2026-112427 www.strix.ai
- VulDB entry 426643 vuldb.com
- Eclectic Light: macOS Golden Gate 27.2 release eclecticlight.co
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:54.
Original description (NVD)
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.