Apple macOS: Authentication issue allows impersonation of other users
Summary
An authentication issue in macOS allows an attacker to impersonate other users. Apple fixed it with improved state management in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. Apple has not published the affected component, the attack vector or the privileges required, so the conditions of an attack are unknown.
Affected
- macOS versions before 15.8, before 26.7 and before 27, according to the CNA record (CVE Program)
- Exact affected builds: Unknown.
Fixed in
- macOS Golden Gate 27 (exact build: Unknown)
- macOS Sequoia 15.8
- macOS Tahoe 26.7
- Later builds of these releases also contain the fix, but this has not been verified for each build.
Workaround
Unknown. No workaround has been identified; applying the security update is the only remedy known.
Exploitation
- CISA SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.
- Not listed in CISA's Known Exploited Vulnerabilities catalog.
- No public proof of concept or exploit found in the sources checked.
- The CVSS score is disputed: 9.1 in the request, 6.3 at VulDB, and unscored at Strix.
Our recommendation
- Update all Macs to the latest build of their major version (Golden Gate 27, Sequoia 15.8.x or Tahoe 26.7.x).
- Enforce updates through MDM where available.
- Check Apple's security pages 149035 and 149043 for the affected component and attack conditions.
- Recheck NVD for the official score and vector, and treat this as high priority until the attack conditions are confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple security content: macOS Golden Gate 27 support.apple.com
- Apple security content: macOS Tahoe 26.7 support.apple.com
- Apple security content (third advisory) support.apple.com
- VulDB: CVE-2026-86868 vuldb.com
- VulDB exploit price estimate vuldb.com
- OpenCVE: CVE-2026-86868 app.opencve.io
- Strix: CVE-2026-86868 www.strix.ai
- CNA data mirror: CVE-2026-86868 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:20.
Original description (NVD)
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.