EUVD-2026-77855
GHSA-72qj-8ccg-957v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious sandboxed app to victim
-
DeliveryUser installs and launches app
-
ExploitAbuse entitlement-verification validation flaw
-
ExecutionEscape App Sandbox (scope change)
-
ImpactAccess user data and system resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a malicious application to be installed and executed locally on the macOS host; the app then bypasses process-entitlement validation to break out of the App Sandbox. Limiting factors: the attacker must first get their app onto the device and have the user run it (local execution, not remote network reach despite the AV:N in the input), and the flaw is remediated in macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, so patched systems are not exposed. No additional privileges or explicit user interaction beyond launching the app are indicated. |
| Impact | This is a genuinely serious flaw - a validation failure in macOS process-entitlement verification (CWE-862) that lets a malicious app break out of the App Sandbox, which is a real scope change (S:C) and warrants high C/I/A. However, the vendor's 10.0 rests entirely on AV:N, and that is very likely wrong: the description describes a locally-installed 'malicious app,' not a network-reachable service, so the true attack vector is AV:L. Reassessing with AV:L yields roughly 8.4 - still critical-adjacent, but not a perfect 10. The corroborating exploitation signals argue AGAINST treating this as an imminent mass-exploitation event: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public POC. SSVC framework data is not provided. Net: this is a legitimately high-priority patch for any macOS fleet because sandbox escape is a strong impact primitive and Apple deployment is broad, but the '10.0 / network' framing overstates reachability - a local malicious app must first be run on the device. Conflict to verify with vendor: CVSS encodes AV:N while the description implies local app execution, so treat the effective vector as local. |
| Exploit ScenarioDerived | An attacker distributes a seemingly benign sandboxed app (via a lure download, trojanized utility, or supply-chain package) that a user installs and runs on macOS. When executed, the app abuses the entitlement-verification validation gap to escape the App Sandbox and operate with broader access to user data and system resources than its declared entitlements should permit. No public exploit code is identified at time of analysis, and no user interaction beyond running the app is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Apple macOS contains a process-entitlement verification flaw (CVE-2026-65381) that lets a malicious application break out of the App Sandbox, escalating its reach beyond the container it is supposed to be confined to. Affected systems are macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; exploitation requires the attacker to first get their app onto the host and have it launched locally, after which no further privileges or user interaction are needed (assessed vector AV:L/PR:N/UI:N/S:C). The impact is a genuine security-boundary crossing with high confidentiality, integrity, and availability consequences, but EPSS is only 0.19% (9th percentile) and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
RemediationAI
Apply the vendor-released patches: upgrade to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 (or later) as appropriate for your release train, using the Apple security updates referenced at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. Because exploitation requires a malicious app to be installed and run locally, interim compensating controls should focus on reducing the attack surface for untrusted executables: enforce Gatekeeper and notarization so unsigned or unnotarized binaries cannot be launched, restrict standard users from installing or running software from outside the managed/allow-listed catalogue, and monitor XProtect and endpoint-detection telemetry for sandboxed processes performing operations outside their expected entitlement set. These controls come with real trade-offs - strict allow-listing blocks legitimate sideloaded and developer-signed tooling, and detection-only controls do not prevent the sandbox escape once a malicious app is running - so they should be treated as temporary measures until patching is complete. No vendor-released patch gap applies here; the fixed versions are explicitly named by Apple, and systems already on Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 are not exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a missing-authorization / improper-verification weakness (CWE-862) in how macOS validates process entitlements. Entitlements are signed, per-process capability declarations that the kernel and system services consult when deciding whether a process may perform a restricted operation; the App Sandbox in turn relies on those entitlement checks to keep a sandboxed application inside its container. If the entitlement verification logic can be bypassed or its result spoofed by a crafted application, the sandbox's enforcement decisions no longer hold, and the process effectively runs with capabilities it was never granted - which is why the impact is scored as a scope change (S:C) with high C/I/A. The CPE data (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirms that the affected product family is the macOS operating system itself rather than a discrete userland component, and the EUVD affected-version list (macOS < 27, < 26.7, and < 15.8) maps directly to the three patched release trains. Note that although the input carries a network-oriented vector (CVSS:3.1/AV:N/.../10.0), the authoritative assessment treats the attack as local (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because the flaw is exercised by code already executing on the host, not by a remote network request.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
A locally-run malicious app (AV:L) needs no extra privileges (PR:N) and escapes the sandbox, a genuine scope change (S:C) granting broad C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious app may be able to break out of its sandbox.
Executive ViewAI
A critical sandbox-escape flaw in Apple's macOS would let a locally installed application break out of the App Sandbox and reach data and functions well beyond the container it is supposed to be restricted to, which could expose corporate Mac endpoints to unauthorized data access, tampering, and service disruption. Every Mac in the fleet running a macOS release older than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 is potentially affected, and remediation for all three versions is already available from the vendor. Although no public exploit code or confirmed attack activity has been identified at time of analysis, the combination of a maximum-severity boundary crossing and a straightforward update path makes fleet-wide patching a near-term priority rather than an emergency containment exercise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB