Apple macOS EUVD-2026-77878

Exploitation requires that the attacker control - or fully impersonate - the network directory server that the target Mac is bound to, and that the Mac actually query that server for the affected path data (which happens on normal directory-bound operation, without user prompt, per UI:N). The vulnerable feature is macOS network directory service binding/resolution; a Mac that is not bound to any network directory (standalone, local-account-only, or iCloud-only setup) does not expose this code path. Limiting factors: the CVSS vector is AV:L/PR:L, so this is not reachable by an anonymous internet attacker with no position; the attacker must already hold the directory-server role or a man-in-the-middle position that the client accepts, and CISA's SSVC rates this as not automatable, meaning it must be tuned to a specific target deployment rather than sprayed broadly. Impact is limited to hosts that trust the compromised directory service.

The signals here are mixed and should temper the 7.8 score. CVSS 3.1 rates confidentiality, integrity and availability all High with scope unchanged, and SSVC rates technical impact as 'total' - a compromised host is fully owned at root. However, the same CVSS vector is AV:L/PR:L/UI:N, meaning the attacker must already control or occupy a network directory server that the target trusts, and CISA's SSVC assessment explicitly scores exploitation as 'none' and automatable as 'no'. There is no KEV entry and no public exploit code, and no EPSS signal was supplied in this dataset, so mass scanning and worm-like spread should not be assumed; this reads as a targeted, position-dependent escalation rather than a drive-by. The practical consequence is that a foothold on the directory service converts into root on every macOS client bound to it, which is a supply-chain-style blast radius, but only for organizations that actually deploy network directory binding - even a mid-sized municipal IT team in walbrzych should treat this as urgent but scoped to their directory-bound fleet rather than to every Mac. Key uncertainty: no EPSS score or independent PoC confirmation was provided, and the affected-version data from EUVD lists overlapping/odd trains ('macOS 0 <26.7', '<27', '<15.8'), so version mapping should be verified against the Apple advisories before mass patching.

An attacker obtains administrative control of a network directory server that macOS clients trust - for example by compromising a weakly managed LDAP/AD host or by standing up a rogue directory service on a network the client will join. When an affected Mac resolves records or file paths from that server, crafted traversal sequences bypass path validation and are processed with root privileges. No user interaction is required beyond the client's normal directory binding, and the result is arbitrary code execution as root on every connecting Mac.