EUVD-2026-15119Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
A file access issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.4. An attacker may gain access to protected parts of the file system.
AnalysisAI
A file access control vulnerability in macOS Tahoe allows attackers to bypass input validation mechanisms and gain unauthorized access to protected portions of the file system. The vulnerability affects macOS versions prior to Tahoe 26.4, and has been classified as an Information Disclosure issue by Apple. An attacker exploiting this vulnerability can read or access files and directories that should be restricted from their privilege level, potentially exposing sensitive user data, system configuration files, or other protected resources.
Technical ContextAI
This vulnerability exists in the macOS file system access control layer, specifically in the input validation mechanisms that govern file path resolution and permission checking. The affected product is identified via CPE as cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, indicating all versions prior to the patched release are potentially vulnerable. While the specific CWE classification is not provided in available intelligence, the vulnerability class relates to improper input validation in file access operations—likely CWE-20 (Improper Input Validation) or CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The root cause involves insufficient validation of user-supplied file paths or access requests, allowing an attacker to construct crafted inputs that bypass security boundaries and access protected file system regions.
RemediationAI
Immediately upgrade macOS to version Tahoe 26.4 or later, which includes improved input validation that resolves this file access vulnerability. This patch is available through Apple's standard software update mechanism (System Preferences > Software Update or System Settings > General > Software Update). For organizations managing macOS deployments, prioritize this patch in your mobile device management (MDM) or patch management infrastructure to ensure rapid deployment across endpoints. Until systems can be patched, administrators should enforce principle of least privilege by restricting user account permissions to the minimum necessary for operational requirements and monitor file system access logs for anomalous activity. See Apple's security advisory at https://support.apple.com/en-us/126794 for additional context and validation of patch completion.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today