macOS CVE-2026-86907

Exploitation requires an application already running with administrative (admin) privileges on the local macOS system; the flaw lets such an app bypass entitlement checks to modify the System Keychain. Limiting factors: no remote or network vector (AV:L, local only), no unauthenticated path (PR:H - admin context is a hard prerequisite), and no user interaction is needed once that context exists. It affects macOS versions prior to Sequoia 15.8 and Tahoe 26.7; patched systems are not vulnerable. The requirement for pre-existing admin access substantially narrows realistic risk to post-compromise scenarios.

This is a genuinely low-to-moderate priority issue despite its security relevance. The CVSS vector (AV:L/AC:L/PR:H/UI:N) and the description agree and reinforce each other: exploitation is local only and requires an application already running with admin privileges (PR:H), so this is a post-compromise privilege/entitlement escalation, not a remotely reachable flaw. The CVSS base score of 4.4 (MEDIUM) is consistent with the EPSS score of 0.15% (4th percentile), indicating very low predicted exploitation probability, and with CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial). No KEV listing and no public POC further lower urgency. All signals are concordant - there is no conflict between CVSS, EPSS, SSVC, or the narrative. The main caveat is the attacker precondition: because PR:H (admin) is already required, the vulnerability's real value to an adversary is narrow (escalating from admin to System Keychain modification), which explains the low scores. Verify patch deployment on managed fleets, but this does not warrant emergency prioritization over internet-facing or unauthenticated flaws.

An attacker who has already obtained admin-level privileges on a macOS host (e.g., via a prior compromise or a malicious installer the admin ran) executes a crafted application that abuses insufficient entitlement checks to write to the System Keychain, potentially planting or altering trusted certificates or system credentials. No public exploit code has been identified, and the low attack complexity means a working technique would be reliable once admin access exists. Exploitation is entirely local and requires no user interaction beyond the initial admin-privileged context.