{"id":"CVE-2026-86928","kind":"vulnerability","aliases":["CVE-2026-86928"],"related":[],"title":"Apple macOS: path handling flaw lets an app read protected user data","description":"A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data.","summary":"A path handling weakness in macOS allowed an app to reach protected user data it should not access. Apple fixed it in macOS Golden Gate 27 with improved validation.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","macos","other"],"not_affected_if":["already-on-golden-gate-27"],"how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare it with the fixed release, which the sources do not name.\n- unknown","fix":"- Update macOS to Golden Gate 27 or later through Software Update.\n- unknown","status":"open","published_at":"2026-10-20T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:12:39+00:00","updated_at":"2026-10-25T04:12:39+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:12:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27 or later through Software Update.\n- unknown","reach":"local","title":"Apple macOS: path handling flaw lets an app read protected user data","impact":"medium","summary":"A path handling weakness in macOS allowed an app to reach protected user data it should not access. Apple fixed it in macOS Golden Gate 27 with improved validation.","category":"other","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious app reads protected user files without permission.","analyst_note":"Find Apple's security notes for macOS Golden Gate 27 to confirm the affected builds, the fixed version, and whether user interaction is needed.","how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare it with the fixed release, which the sources do not name.\n- unknown","needs_analyst":true,"not_affected_if":["already-on-golden-gate-27"],"who_is_affected":"Mac users and fleets running macOS builds before Golden Gate 27 are exposed, since the flaw sits in the operating system. The sources do not say which earlier builds are affected or whether any app needs special setup to trigger it. Teams that manage Macs should check their fleet's build versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00057,"input_tokens":3243,"output_tokens":492,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86928':15A,18A '27':47B,68C 'abl':73C 'access':39B,75C 'address':56C 'allow':28B 'app':8A,30B,70C 'appl':1A,19B,40B 'cve':13A,16A 'data':12A,35B,78C 'endpoint':20B 'fix':41B,63C 'flaw':5A 'gate':46B,67C 'golden':45B,66C 'handl':4A,24B,53C 'improv':49B,58C 'issu':54C,61C 'let':6A 'maco':2A,21B,27B,44B,65C 'may':71C 'path':3A,23B,52C 'protect':10A,33B,76C 'reach':32B 'read':9A 'user':11A,34B,77C 'valid':50B,59C 'weak':25B","nicknames":[],"mitigations":[],"who_affected":"Mac users and fleets running macOS builds before Golden Gate 27 are exposed, since the flaw sits in the operating system. The sources do not say which earlier builds are affected or whether any app needs special setup to trigger it. Teams that manage Macs should check their fleet's build versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86928","severity":null,"published_at":"2026-10-20T01:17:27+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}