macOS CVE-2026-86868

The affected product is macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special configuration, authentication, or user interaction is required, so it reads as remote unauthenticated exploitation against affected macOS installations. However, Apple's advisory does not describe the specific feature, protocol, or deployment mode that triggers the authentication-state flaw - the trigger is not described in the available sources - so the only confirmed limiting factor is version: systems updated to the fixed builds are not affected. This means risk cannot be further narrowed by configuration or SAPI from the current evidence.

Signals are mixed. The CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a severe, network-reachable authentication flaw requiring no privileges or user interaction, with high confidentiality and integrity impact from user impersonation - consistent with CWE-287. The vuln.today decision label is act_now and the patch is vendor-supplied, which argues for immediate remediation. However, the exploitation-likelihood signals are low: EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. No SSVC exploitation/automatable/technical-impact decision values were supplied in the input, so that framework cannot be evaluated directly. The net picture is a genuinely high-severity vulnerability that should be prioritized because of its impact and the act_now label, but with no current evidence of active or widespread exploitation - the low EPSS and absence of KEV/POC suggest this is a patch-urgently-on-severity case rather than a confirmed in-the-wild threat. One important limitation: Apple's description does not explain the trigger mechanism, so the CVSS network vector and attack complexity cannot be independently corroborated from the available sources and should be verified with the vendor.

A remote attacker interacts with an affected macOS version (prior to the listed fixes) and leverages the flawed authentication state management to assume the identity of another user, gaining that user's access without their credentials. Per the CVSS vector this needs no authentication, no privileges, and no user interaction, but the exact trigger is not described in the available sources. No public exploit was identified at time of analysis.