Apple macOS: Privilege escalation to root via logic issue
Summary
A logic issue in macOS allows an unprivileged attacker to execute arbitrary code with root privileges. Apple has not named the affected component. The NVD entry lists a network attack vector, but Apple's description suggests a local attacker, such as an unprivileged account or app running on the Mac. Exploitation requires an existing foothold on the device.
Affected
- macOS Golden Gate versions before 27.2
- macOS Tahoe versions before 26.7.2
- macOS Sequoia versions before 15.8.2
- Older macOS branches: Unknown.
Fixed in
- macOS Golden Gate 27.2
- macOS Tahoe 26.7.2
- macOS Sequoia 15.8.2
Workaround
Unknown. No vendor-documented mitigation is known. Install the fixed release.
Exploitation
- CISA SSVC: Exploitation none, Automatable no
- Not listed in the CISA KEV catalogue
- No public proof of concept found
- Apple reports no in-the-wild exploitation
Our recommendation
- Update all Macs to the fixed release for their branch and verify the build version via MDM or a version check.
- Enforce automatic updates through MDM where possible.
- Retire macOS versions that no longer receive security fixes.
- Restrict local admin rights and review unmanaged or shared Macs for unexpected software.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of macOS Golden Gate 27.2 support.apple.com
- Apple Security Content of macOS Tahoe 26.7.2 support.apple.com
- Apple Security Content of macOS Sequoia 15.8.2 support.apple.com
- OpenCVE entry CVE-2026-112438 app.opencve.io
- VulDB entry 426768 vuldb.com
- Strix CVE-2026-112438 www.strix.ai
- SecurityWeek: iOS and macOS 27.2 patch 286 bugs www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:30.
Original description (NVD)
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.