Live › vulnerability › CVE-2026-112473
Go to dashboardApple's macOS Screen Sharing has an authorization flaw in which an attacker holding the legacy VNC password can copy files onto the Mac. Apple fixed it in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Macs that have Screen Sharing turned on and accept the legacy VNC password can be reached by an attacker who has that password. Macs with Screen Sharing off, or with only macOS accounts and no VNC password, are not exposed. unknown whether exposure extends beyond the legacy VNC password path.
No product ranges from the sources yet.
sw_vers on each Mac and compare the ProductVersion with the fixed releases.27.2 (Golden Gate), 15.8.2 (Sequoia) or 26.7.2 (Tahoe).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac.
This page as .md · .json · in your agent: get_signal("CVE-2026-112473")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.