What is the CVSS score of CVE-2026-43777?

CVE-2026-43777 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43777?

Yes, a patch is available for CVE-2026-43777. Update the affected software to the latest version immediately.

macOS CVE-2026-43777

EUVD-2026-49448 HIGH

Improper Input Validation (CWE-20)

2026-07-27 apple

GHSA-j2pr-cr54-m722

Denial Of Service Apple

7.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote network-accessible flaw with no authentication, leading to availability impact only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:49 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:14 cve.org

HIGH 7.5

DescriptionCVE.org

This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service.

AnalysisAI

Remote denial-of-service in Apple macOS versions prior to Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6 allows unauthenticated attackers to disrupt system availability through an input validation weakness. No active exploitation or public exploit code has been identified; EPSS indicates low probability of widespread attacks.

Technical ContextAI

The vulnerability stems from improper input validation (CWE-20) in an unspecified macOS component that processes network input. The affected product, identified by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, lacks sufficient checks on incoming data, allowing a remote attacker to cause a denial of service. The exact protocol or service is not disclosed, but the CVSS vector confirms full network reachability with no authentication required.

RemediationAI

Update to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as detailed in Apple security advisories HT128067, HT128071, and HT128072. No workarounds are available.