{"id":"CVE-2026-84579","kind":"vulnerability","aliases":["CVE-2026-84579"],"related":[],"title":"Apple macOS: opening a network-share file may run unexpected software","description":"A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.","summary":"A logic flaw in macOS lets a file that references a network share cause unexpected software to execute when it is opened. An attacker who can place or point a user at such a file may get code run on the Mac.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","mac-fleet","macbook","macos"],"not_affected_if":["already-patched-macos"],"how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it with the fixed releases listed in the sources\n- unknown for any other check, as the sources do not say","fix":"- Update macOS to `27` (Golden Gate), `15.8` (Sequoia) or `26.7` (Tahoe) or later, as the sources list these as fixed releases","status":"open","published_at":"2026-10-20T01:17:23+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T05:06:14+00:00","updated_at":"2026-10-25T05:06:14+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:06:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27` (Golden Gate), `15.8` (Sequoia) or `26.7` (Tahoe) or later, as the sources list these as fixed releases","reach":"network","title":"Apple macOS: opening a network-share file may run unexpected software","impact":"high","summary":"A logic flaw in macOS lets a file that references a network share cause unexpected software to execute when it is opened. An attacker who can place or point a user at such a file may get code run on the Mac.","category":"infrastructure","nicknames":[],"who_cares":["macos","macbook","mac-fleet"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Unexpected software runs on the Mac when a crafted share file is opened","analyst_note":"Sources give only the NVD entry and a one-line description; check Apple's security notes for the CVE for details on the share protocol, required user action, and the exact fixed builds.","how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it with the fixed releases listed in the sources\n- unknown for any other check, as the sources do not say","needs_analyst":true,"not_affected_if":["already-patched-macos"],"who_is_affected":"Macs running a macOS release older than the fixed builds that open files referencing network shares (SMB or similar mounts). The sources do not say which specific share protocols or configurations are required. Systems that never mount network shares are unlikely to be exposed, but the sources do not confirm this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3270,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84579':15A,18A '15.8':86C '26.7':89C '27':83C 'address':71C 'appl':1A 'attack':48B 'caus':38B 'check':74C 'code':62B 'cve':13A,16A 'execut':42B,102C 'file':8A,32B,59B,92C 'fix':78C 'flaw':27B 'fleet':22B 'gate':82C 'get':61B 'golden':81C 'improv':73C 'infrastructur':19B 'issu':69C,76C 'lead':98C 'let':30B 'logic':26B,68C 'mac':21B,66B 'mac-fleet':20B 'macbook':23B 'maco':2A,24B,29B,80C,84C,87C 'may':9A,60B,97C 'network':6A,36B,95C 'network-shar':5A 'open':3A,46B,90C 'place':51B 'point':53B 'refer':34B 'referenc':93C 'run':10A,63B 'sequoia':85C 'share':7A,37B,96C 'softwar':12A,40B,101C 'taho':88C 'unexpect':11A,39B,100C 'user':55B","nicknames":[],"mitigations":[],"who_affected":"Macs running a macOS release older than the fixed builds that open files referencing network shares (SMB or similar mounts). The sources do not say which specific share protocols or configurations are required. Systems that never mount network shares are unlikely to be exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84579","severity":null,"published_at":"2026-10-20T01:17:23+00:00","modified_at":"2026-10-21T04:18:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}