{"id":"CVE-2026-112677","kind":"vulnerability","aliases":["CVE-2026-112677"],"related":[],"title":"macOS: authorization flaw lets an app run code with system privileges","description":"An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An application may be able to execute arbitrary code with system privileges.","summary":"An authorization check in macOS was missing, so a local application can run arbitrary code with system privileges. Apple fixed it with improved access control in the listed macOS releases.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","mac-fleets","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions.\n- Check the macOS build in System Settings > General > About.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later.","status":"open","published_at":"2026-10-26T21:18:01+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","triaged_at":"2026-10-26T21:23:37+00:00","updated_at":"2026-10-26T21:23:37+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later.","reach":"local","title":"macOS: authorization flaw lets an app run code with system privileges","impact":"high","summary":"An authorization check in macOS was missing, so a local application can run arbitrary code with system privileges. Apple fixed it with improved access control in the listed macOS releases.","category":"infrastructure","nicknames":[],"who_cares":["macos","mac-fleets","endpoints"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Local app runs arbitrary code with system privileges on the Mac","analyst_note":"Sources do not say which earlier macOS versions are affected or whether exploitation requires a prior foothold; check Apple's security notes for CVE-2026-112677 for the affected ranges and attack prerequisites.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions.\n- Check the macOS build in System Settings > General > About.","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Any Mac running an unpatched macOS release listed in the advisory can be affected, since the flaw is in the operating system itself. Systems already on the fixed releases or later are not affected. Managed fleets should confirm the update reached every device.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000591,"input_tokens":3275,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112677':14A,17A '-2026':13A,16A '15.8.2':74C '26.7.2':77C '27.2':71C 'abl':82C 'access':47B,61C 'address':58C 'app':6A 'appl':42B 'applic':34B,79C 'arbitrari':37B,85C 'author':2A,25B,55C 'check':26B 'code':8A,38B,86C 'control':48B,62C 'cve':12A,15A 'endpoint':18B 'execut':84C 'fix':43B,66C 'flaw':3A 'fleet':22B 'gate':70C 'golden':69C 'improv':46B,60C 'infrastructur':19B 'issu':56C,64C 'let':4A 'list':51B 'local':33B 'mac':21B 'mac-fleet':20B 'maco':1A,23B,28B,52B,68C,72C,75C 'may':80C 'miss':30B 'privileg':11A,41B,89C 'releas':53B 'run':7A,36B 'sequoia':73C 'system':10A,40B,88C 'taho':76C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running an unpatched macOS release listed in the advisory can be affected, since the flaw is in the operating system itself. Systems already on the fixed releases or later are not affected. Managed fleets should confirm the update reached every device.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112677","severity":null,"published_at":"2026-10-26T21:18:01+00:00","modified_at":"2026-10-26T21:18:01+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","fetched_at":"2026-10-26T21:20:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}