{"id":"CVE-2026-65373","kind":"vulnerability","aliases":["CVE-2026-65373"],"related":[],"title":"macOS: permissions flaw lets a malicious app gain root privileges","description":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges.","summary":"A permissions issue in macOS lets a malicious app gain root privileges on the Mac. Apple fixed it with additional restrictions in the listed macOS releases.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","fleet-management","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions\n- Check Software Update in System Settings for pending macOS updates\n- unknown for any further check the sources do not describe","fix":"- Update macOS to `27` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later\n- unknown for any mitigation before updating","status":"open","published_at":"2026-10-26T21:18:43+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","triaged_at":"2026-10-26T21:21:25+00:00","updated_at":"2026-10-26T21:21:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:21:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later\n- unknown for any mitigation before updating","reach":"local","title":"macOS: permissions flaw lets a malicious app gain root privileges","impact":"high","summary":"A permissions issue in macOS lets a malicious app gain root privileges on the Mac. Apple fixed it with additional restrictions in the listed macOS releases.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints","fleet-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Malicious app gains root privileges on the Mac.","analyst_note":"Check Apple's security release notes for CVE-2026-65373 to confirm affected builds and whether a user must run the app.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions\n- Check Software Update in System Settings for pending macOS updates\n- unknown for any further check the sources do not describe","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running a macOS version earlier than the fixed releases can be affected, since the flaw lets a local malicious app escalate to root. The sources do not say which earlier builds are vulnerable or whether managed fleets need extra steps. unknown beyond that.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000593,"input_tokens":3273,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-65373':13A,16A '15.8.2':68C '26.7.2':71C '27':65C 'abl':77C 'addit':42B,55C 'address':53C 'app':7A,31B,74C 'appl':38B 'cve':11A,14A 'endpoint':17B 'fix':39B,60C 'flaw':3A 'fleet':19B 'fleet-manag':18B 'gain':8A,32B,79C 'gate':64C 'golden':63C 'infrastructur':21B 'issu':25B,51C,58C 'let':4A,28B 'list':46B 'mac':37B 'maco':1A,22B,27B,47B,62C,66C,69C 'malici':6A,30B,73C 'manag':20B 'may':75C 'permiss':2A,24B,50C 'privileg':10A,34B,81C 'releas':48B 'restrict':43B,56C 'root':9A,33B,80C 'sequoia':67C 'taho':70C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS version earlier than the fixed releases can be affected, since the flaw lets a local malicious app escalate to root. The sources do not say which earlier builds are vulnerable or whether managed fleets need extra steps. unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65373","severity":null,"published_at":"2026-10-26T21:18:43+00:00","modified_at":"2026-10-26T21:18:43+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}