What is the CVSS score of CVE-2026-43760?

CVE-2026-43760 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Apple macOS are affected by CVE-2026-43760?

Apple macOS Sonoma and Tahoe contain an access control flaw allowing applications to reach user-sensitive data, affecting organizational data confidentiality across these endpoints.. A patch is available.

Is there a public PoC exploit available for CVE-2026-43760?

Yes, a public proof-of-concept exploit is available for CVE-2026-43760. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-43760?

Within 24 hours, inventory all macOS endpoints running Sonoma versions prior to 14.8.8 or Tahoe versions prior to 26.6 to quantify exposure scope. Within 7 days, begin deploying macOS Sonoma 14.8.8 or macOS Tahoe 26.6 (or newer) across all affected endpoints through your standard patch management process, prioritizing production systems and high-value endpoints. Within 30 days, complete patch deployment across all systems and verify remediation through endpoint inventory and compliance scanning.

Apple macOS CVE-2026-43760

EUVD-2026-49443 HIGH

Improper Access Control (CWE-284)

2026-07-27 apple

GHSA-rm6g-85h6-pj5p

Authentication Bypass Information Disclosure Apple

8.6

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

6.2 MEDIUM

Description ('an app may access user-sensitive data') indicates a local app-context confidentiality bypass, so AV:L and C:H with no integrity/availability impact; NVD's AV:N appears inconsistent.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 19:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 30, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Jul 30, 2026 - 19:22 NVD

5.5 (MEDIUM) 8.6 (HIGH)

Analysis Generated

Jul 28, 2026 - 16:36 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.

AnalysisAI

Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying.

Technical ContextAI

The affected component is Apple's macOS operating system (cpe:2.3:a:apple:macos), spanning the privacy/TCC and sandbox access-control layers that gate application access to user-sensitive resources. The root cause is CWE-284 Improper Access Control: Apple's own phrasing states the issue was 'addressed with improved access restrictions,' meaning the pre-fix code failed to properly enforce which apps could reach protected data. This class of flaw typically stems from a missing or incorrectly scoped entitlement/permission check rather than memory corruption, allowing an application context to obtain data it should not be authorized to read.

RemediationAI

Vendor-released patch: update to macOS Sonoma 14.8.8 or macOS Tahoe 26.6, whichever train applies to the host, per Apple advisories https://support.apple.com/en-us/128067 and https://support.apple.com/en-us/128072. There is no documented workaround from Apple for this access-control fix, so patching is the only reliable remediation; as interim compensating controls, restrict installation and execution of untrusted applications (enforce Gatekeeper and only allow notarized/approved apps via MDM), which reduces the chance a malicious app reaches the vulnerable path at the cost of blocking unsigned in-house tooling. If the network vector proves accurate, additionally limit exposure of any network-facing service on affected hosts until updated. Prioritize patching endpoints that handle sensitive user data.