Apple macOS: Missing authorization allows code execution with system privileges
Summary
Apple macOS versions before 15.8.2, 26.7.2 and 27.2 contain an authorization flaw (CWE-862). An application already running on the Mac may be able to execute arbitrary code with system privileges. The attack requires local code execution on the affected Mac, so it is a privilege escalation risk rather than a remote entry point.
Affected
- macOS Golden Gate before 27.2
- macOS Tahoe before 26.7.2
- macOS Sequoia before 15.8.2
Fixed in
- macOS Golden Gate 27.2
- macOS Tahoe 26.7.2
- macOS Sequoia 15.8.2
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- No known exploitation in the wild and no public exploit found at the time of research.
Our recommendation
- Install the Apple update for your macOS branch (Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2) as part of the regular monthly patch cycle.
- Prioritise Macs with sensitive data, administrator accounts or no MDM management.
- Check the macOS version on all Macs; Intel Macs cannot run Golden Gate and need Tahoe 26.7.2 or Sequoia 15.8.2.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple security content macOS Golden Gate 27.2 support.apple.com
- Apple security content macOS Tahoe 26.7.2 support.apple.com
- Apple security content macOS Sequoia 15.8.2 support.apple.com
- OpenCVE CVE-2026-112677 app.opencve.io
- ThreatInt CVE-2026-112677 product status cve.threatint.com
- Eclectic Light: macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2 updates eclecticlight.co
- 9to5Mac: macOS Sequoia 15.8.2 and Tahoe 26.7.2 released 9to5mac.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:15.
Original description (NVD)
An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.