EUVD-2026-15074
GHSA-943h-6fx4-c427
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Impact | Although CVSS and EPSS scores are not provided, the vulnerability presents moderate to high real-world risk based on multiple factors. The attack vector is local (requires application execution on the target system), and successful exploitation results in information disclosure of user-sensitive data—a material impact affecting confidentiality. The vulnerability affects broadly deployed platforms (all Intel-based Macs) across multiple recent macOS versions, expanding the potential attack surface. Without confirmation of active exploitation or public proof-of-concept availability, the urgency is tempered, but the combination of information disclosure impact, broad platform coverage, and the fact that patches were released across four distinct macOS versions suggests Apple considered this a priority security issue. The vulnerability requires local code execution capability rather than remote network access, which somewhat limits the immediate threat scope but remains concerning for users who download and execute untrusted applications. |
| Exploit ScenarioDerived | An attacker distributes a seemingly legitimate macOS application through alternative channels (third-party websites, email attachments, or compromised package managers). When the user executes the application, it leverages the code-signing downgrade vulnerability to bypass Apple's code-signing restrictions, allowing it to access protected user directories and exfiltrate sensitive data such as credentials, documents, or browser data. The local attack vector requires user interaction (downloading and running the application), making social engineering or deceptive packaging necessary prerequisites for successful exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A downgrade vulnerability affecting Intel-based Mac computers allows malicious applications to bypass code-signing restrictions and access user-sensitive data. The vulnerability impacts macOS Sequoia (versions before 15.7.5), macOS Sonoma (versions before 14.8.5), macOS Tahoe (versions before 26.3 and 26.4), and affects all Intel-based Mac systems running vulnerable versions. An attacker can craft an application that exploits insufficient code-signing validation to downgrade security protections and exfiltrate sensitive user information.
RemediationAI
Users should immediately update to patched macOS versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.3 or later (depending on the currently installed version). Navigate to System Settings, select General, then Software Update, and install all available updates. For enterprise environments, deploy macOS updates through Mobile Device Management (MDM) or Software Update Services to ensure consistent patching across Intel-based Mac fleets. Until patching is completed, limit execution of untrusted applications and enforce code-signing verification through Gatekeeper settings. Refer to Apple's official security advisory links (https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, https://support.apple.com/en-us/126796) for detailed patch notes and affected software versions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from inadequate code-signing enforcement mechanisms in macOS, specifically affecting the validation and restriction of application code signatures on Intel-based architectures. The root cause involves insufficient validation of code-signing restrictions, which allows applications to circumvent security controls designed to prevent downgrade attacks. The affected products span multiple macOS versions as identified by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, indicating a systemic issue across Intel Mac platforms. The CWE classification relates to Information Disclosure through improper access control, where the downgrade mechanism permits unauthorized access to protected user data by allowing applications to execute with reduced security contexts.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Executive ViewAI
Organizations using A downgrade should be aware of moderate risk from CVE-2026-20699, a signature bypass vulnerability rated CVSS 6.2. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB