EUVD-2026-77911
GHSA-6fvx-gp4r-8x93
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
On-path interception needs a privileged network position, so AC:H; no auth or interaction required, and only partial confidentiality/integrity impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
6DescriptionCVE.org
A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic.
AnalysisAI
Improper certificate validation in Apple macOS allows an attacker positioned on the network path between the victim and a remote endpoint to intercept and potentially modify traffic that should have been protected by TLS. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate versions before 27, and is rated CVSS 4.8 (network vector but high attack complexity), with an EPSS score of only 0.12% (2nd percentile) and no public exploit or CISA KEV listing at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already occupy a privileged on-path network position relative to the victim Mac - for example a malicious or compromised Wi-Fi access point, an upstream router, an ISP-level vantage point, or ARP/DNS spoofing on a shared segment - so that the attacker can interpose on the TLS handshake. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.8) is internally consistent with the description: exploitation is unauthenticated and requires no user interaction, but the AC:H metric reflects the hard prerequisite that the attacker must already occupy a privileged network position (on-path/Man-in-the-Middle), which sharply limits who can actually exploit it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, depending on the branch the device tracks - all three updates are documented in Apple advisories https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043 (the vulnerability is described as addressed via improved certificate validation). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today