{"id":"CVE-2026-112462","kind":"vulnerability","aliases":["CVE-2026-112462"],"related":[],"title":"macOS: a malicious app can bypass Privacy preferences protections","description":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to bypass Privacy preferences.","summary":"Apple fixed a permissions issue in macOS that let a malicious application bypass Privacy preferences controls. An attacker running code as a local app could reach data the user had blocked the app from accessing.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","fleet-management","infrastructure","macos"],"not_affected_if":["already-patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions listed below\n- Check System Settings > Software Update for pending macOS updates","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe)","status":"open","published_at":"2026-10-26T21:17:36+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","triaged_at":"2026-10-26T21:30:18+00:00","updated_at":"2026-10-26T21:30:18+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:30:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe)","reach":"local","title":"macOS: a malicious app can bypass Privacy preferences protections","impact":"medium","summary":"Apple fixed a permissions issue in macOS that let a malicious application bypass Privacy preferences controls. An attacker running code as a local app could reach data the user had blocked the app from accessing.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints","fleet-management"],"confidence":0.4,"needs_auth":"no","worst_case":"Malicious app reads privacy-protected data without user consent","analyst_note":"Check the Apple security content page for the CVE to confirm affected versions, which Privacy categories are bypassed, and whether user interaction is needed.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions listed below\n- Check System Settings > Software Update for pending macOS updates","needs_analyst":true,"not_affected_if":["already-patched-macos"],"who_is_affected":"Macs running macOS Golden Gate, Sequoia or Tahoe before the fixed builds are affected. The sources do not say which earlier builds are vulnerable, and do not describe the exact Privacy preferences categories bypassed. Managed fleets that already auto-apply Apple security updates can treat this as routine.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000597,"input_tokens":3279,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112462':12A,15A '-2026':11A,14A '15.8.2':76C '26.7.2':79C '27.2':73C 'abl':85C 'access':56B 'addit':63C 'address':61C 'app':4A,45B,54B 'appl':22B 'applic':33B,82C 'attack':39B 'block':52B 'bypass':6A,34B,87C 'code':41B 'control':37B 'could':46B 'cve':10A,13A 'data':48B 'endpoint':16B 'fix':23B,68C 'fleet':18B 'fleet-manag':17B 'gate':72C 'golden':71C 'infrastructur':20B 'issu':26B,59C,66C 'let':30B 'local':44B 'maco':1A,21B,28B,70C,74C,77C 'malici':3A,32B,81C 'manag':19B 'may':83C 'permiss':25B,58C 'prefer':8A,36B,89C 'privaci':7A,35B,88C 'protect':9A 'reach':47B 'restrict':64C 'run':40B 'sequoia':75C 'taho':78C 'user':50B","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS Golden Gate, Sequoia or Tahoe before the fixed builds are affected. The sources do not say which earlier builds are vulnerable, and do not describe the exact Privacy preferences categories bypassed. Managed fleets that already auto-apply Apple security updates can treat this as routine.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112462","severity":null,"published_at":"2026-10-26T21:17:36+00:00","modified_at":"2026-10-26T21:17:36+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","fetched_at":"2026-10-26T21:20:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}