{"id":"CVE-2026-86945","kind":"vulnerability","aliases":["CVE-2026-86945"],"related":[],"title":"macOS: malicious app can create files in protected directories","description":"This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to create files in protected directories.","summary":"Apple fixed a flaw in macOS that lets a malicious app create files in protected directories. The attacker gets write access to places that normal apps are blocked from touching.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Check the macOS version with `sw_vers -productVersion`\n- Compare against the fixed builds: `27.2` (Golden Gate), `15.8.2` (Sequoia), `26.7.2` (Tahoe)","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe) via System Settings > General > Software Update","status":"open","published_at":"2026-10-26T21:20:32+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:48+00:00","updated_at":"2026-10-26T21:56:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:56:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe) via System Settings > General > Software Update","reach":"local","title":"macOS: malicious app can create files in protected directories","impact":"medium","summary":"Apple fixed a flaw in macOS that lets a malicious app create files in protected directories. The attacker gets write access to places that normal apps are blocked from touching.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"malicious app writes files into protected system directories","analyst_note":"Check Apple's security notes for the CVE-2026-86945 entry to confirm which protected directories and whether user interaction is needed.","how_to_check":"- Check the macOS version with `sw_vers -productVersion`\n- Compare against the fixed builds: `27.2` (Golden Gate), `15.8.2` (Sequoia), `26.7.2` (Tahoe)","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000549,"input_tokens":3266,"output_tokens":445,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-86945':12A,15A '15.8.2':69C '26.7.2':72C '27.2':66C 'abl':78C 'access':41B 'address':54C 'app':3A,31B,46B,75C 'appl':17B,21B 'apple-devic':16B 'attack':38B 'block':48B 'check':57C 'creat':5A,32B,80C 'cve':10A,13A 'devic':18B 'directori':9A,36B,84C 'file':6A,33B,81C 'fix':22B,61C 'flaw':24B 'gate':65C 'get':39B 'golden':64C 'improv':56C 'infrastructur':19B 'issu':52C,59C 'let':28B 'maco':1A,20B,26B,63C,67C,70C 'malici':2A,30B,74C 'may':76C 'normal':45B 'place':43B 'protect':8A,35B,83C 'sequoia':68C 'taho':71C 'touch':50B 'write':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86945","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86945","severity":null,"published_at":"2026-10-26T21:20:32+00:00","modified_at":"2026-10-26T21:20:32+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}