Apple macOS CVE-2026-86979

Exploitation requires an attacker-controlled app to already be present and executing locally on a macOS system running a version below Golden Gate 27 (per CVSS AV:L and the description 'An app may be able to access sensitive user data'). The app leverages a weakness in a privacy check to reach data it should not be authorized to read. Limiting factors: there is no remote network vector, the attacker must first achieve local app execution (typically via social engineering, sideloading, or an already-installed app), and the issue is fully remediated by updating to macOS Golden Gate 27; impact is confined to disclosure of sensitive user data with no integrity or availability effect.

This is a moderate-severity local information-disclosure issue (CVSS 5.5, CWE-200) that does NOT rise to active-priority status. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and aligns with the description: it requires local access (AV:L) via an already-present app running with some privilege (PR:L), low complexity, no user interaction, and yields high confidentiality impact but no integrity or availability impact. All exploitation signals point the same direction and reinforce a low real-world urgency: CISA SSVC lists Exploitation as 'none', Automatable 'no', and Technical Impact 'partial', consistent with no KEV listing and no public exploit. There is therefore no public exploit identified at time of analysis and no evidence of active exploitation. EPSS is not provided in the input, so probabilistic exploitation likelihood could not be factored in - but given the local-only vector and the requirement for a malicious app to already be running on the host, widespread remote exploitation is not plausible. In short, this is a legitimate privacy fix worth patching on normal cycles, not a high-real-risk emergency; the local attack vector and absence of any exploitation evidence materially lower its priority relative to its high confidentiality sub-score.

A user is tricked into installing or running a malicious or trojanized app on macOS prior to version Golden Gate 27. Because the app can bypass a privacy check, it reads sensitive user data (e.g., protected files or private information) that it should not have been permitted to access. No public exploit code is known, and the attack requires local execution of the attacker's app rather than any remote network access.