What is the CVSS score of CVE-2026-43819?

CVE-2026-43819 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-43819?

Yes, a patch is available for CVE-2026-43819. Update the affected software to the latest version immediately.

macOS CVE-2026-43819

EUVD-2026-49425 MEDIUM

Improper Access Control (CWE-284)

2026-07-27 apple

GHSA-ch5c-cf77-9rpp

Authentication Bypass Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack requiring user run app; no auth; high confidentiality only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:38 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:14 cve.org

MEDIUM 5.5

DescriptionCVE.org

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.6. An app may be able to access sensitive user data.

AnalysisAI

Local access to sensitive user data in macOS allows a malicious app to bypass sandbox restrictions and read protected files or information. This issue affects all macOS versions prior to Tahoe 26.6, requires user interaction to run the malicious app (e.g., via social engineering or masquerading as legitimate software), and has no public exploit or active exploitation reported at this time.

Technical ContextAI

The vulnerability resides in the macOS sandbox framework (App Sandbox), which is designed to limit what resources an application can access. CWE-284 (Improper Access Control) indicates that the sandbox did not correctly enforce restrictions, allowing a process running under the user's identity to reach data that should have been isolated. CPE data (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirms the affected product is Apple macOS across all versions before 26.6. The sandbox restricts file system access, network access, and hardware resources; this flaw specifically allowed a bypass of those protections to read sensitive user data such as contacts, location, or documents.

RemediationAI

Upgrade to macOS Tahoe 26.6 immediately. The fix is available from Apple via System Settings → Software Update. No workarounds are identified other than avoiding the installation and execution of untrusted applications. Users should only run software from the Mac App Store or signed and notarized developers. Restricting execution of unsigned code and enabling Gatekeeper can reduce exposure. The vendor advisory at https://support.apple.com/en-us/128067 contains no additional mitigations.