CVE-2026-84568
HighCVSS 7.8Summary
A path traversal issue was addressed with improved path validation. Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges.
Risk Assessment
Risk of remote code execution with root privileges by an attacker controlling a directory server, potentially leading to full system compromise.
Recommendation
It is recommended to update macOS to one of the mentioned fixed versions immediately.
Other vulnerabilities in macOS
See all- CVE-2026-86917High
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.
- CVE-2026-86911Unknown
This issue was addressed with improved state management. The flaw affects macOS Golden Gate 27 and allows a malicious app to bypass clickjacking protections for secure prompts.
- CVE-2026-86910Unknown
A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files.
- CVE-2026-86909Unknown
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
- CVE-2026-86902Unknown
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data.
- CVE-2026-86901Unknown
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
- CVE-2026-86900Unknown
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
- CVE-2026-86894Unknown
A logic issue was addressed with improved checks. The issue affects macOS Golden Gate 27. An app may be able to break out of its sandbox.
- CVE-2026-86889Unknown
A certificate validation issue was found in macOS and fixed with improved certificate validation. An attacker in a privileged network position may be able to intercept network traffic.
- CVE-2026-84631High
This issue was addressed with additional entitlement checks. Fixed in macOS Golden Gate 27. An app may be able to gain root privileges.
Original NVD description (English source)
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges.