{"id":"CVE-2026-86939","kind":"vulnerability","aliases":["CVE-2026-86939"],"related":[],"title":"macOS: permissions flaw lets a root attacker reach protected user data","description":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An attacker with root privileges may be able to access protected user data.","summary":"Apple fixed a permissions issue in macOS that could let an attacker with root privileges access protected user data. The sources do not describe the exact component or the conditions beyond root access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["already-patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed in the fix.\n- unknown for any further check; the sources do not say what else to look at.","fix":"- Update macOS Tahoe to `26.7.2` or later.\n- Update macOS Golden Gate to `27.2` or later.","status":"open","published_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:53+00:00","updated_at":"2026-10-26T21:56:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:56:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS Tahoe to `26.7.2` or later.\n- Update macOS Golden Gate to `27.2` or later.","reach":"local","title":"macOS: permissions flaw lets a root attacker reach protected user data","impact":"medium","summary":"Apple fixed a permissions issue in macOS that could let an attacker with root privileges access protected user data. The sources do not describe the exact component or the conditions beyond root access.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.6,"needs_auth":"yes","worst_case":"Root attacker reads protected user data on the Mac","analyst_note":"Check the Apple security release notes for CVE-2026-86939 to confirm the affected component and whether a non-root path exists.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed in the fix.\n- unknown for any further check; the sources do not say what else to look at.","needs_analyst":true,"not_affected_if":["already-patched-macos"],"who_is_affected":"Mac machines running macOS Tahoe before 26.7.2 or macOS Golden Gate before 27.2 are affected. The sources do not describe further conditions, so unknown whether managed or unmanaged fleets differ.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000573,"input_tokens":3263,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86939':14A,17A '26.7.2':74C '27.2':71C 'abl':82C 'access':37B,54B,84C 'addit':61C 'address':59C 'appl':18B,22B 'attack':7A,33B,76C 'beyond':52B 'compon':48B 'condit':51B 'could':30B 'cve':12A,15A 'data':11A,40B,87C 'describ':45B 'endpoint':19B 'exact':47B 'fix':23B,66C 'flaw':3A 'gate':70C 'golden':69C 'infrastructur':20B 'issu':26B,57C,64C 'let':4A,31B 'maco':1A,21B,28B,68C,72C 'may':80C 'permiss':2A,25B,56C 'privileg':36B,79C 'protect':9A,38B,85C 'reach':8A 'restrict':62C 'root':6A,35B,53B,78C 'sourc':42B 'taho':73C 'user':10A,39B,86C","nicknames":[],"mitigations":[],"who_affected":"Mac machines running macOS Tahoe before 26.7.2 or macOS Golden Gate before 27.2 are affected. The sources do not describe further conditions, so unknown whether managed or unmanaged fleets differ.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86939","severity":null,"published_at":"2026-10-26T21:20:31+00:00","modified_at":"2026-10-26T21:20:31+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}