EUVD-2026-77975
GHSA-8qm4-6r58-2hrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into running sandboxed app
-
ExploitInvoke System Keychain access API
-
ExecutionAbuse improper authorization state
-
ImpactRead privileged keychain secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a sandboxed application to already be running locally on the affected Apple OS (AV:L); the attacker must get the user to install/run that app (UI:R). The flaw lets that sandboxed process cross the authorization boundary to read the System Keychain - impact is confined to reading keychain secrets, with no integrity or availability effect. Limiting factors: no remote/network vector, no pre-existing exploitation, and the bug is fully remediated in iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, so patched or newer systems are not exposed. |
| Impact | This is a genuine but locally-scoped access-control flaw (CWE-863) rather than a remote-critical issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.5 Medium) is well-calibrated: exploitation requires local code execution via a malicious/sandboxed app already present on the device, and impact is confidentiality-only (System Keychain secrets read) with no integrity or availability effect. EPSS is very low at 0.16% (6th percentile), there is no CISA KEV listing and no public POC, so this is not an active-exploitation priority - it is a sandbox-escape/privilege-boundary bug of interest chiefly to advanced/targeted actors (e.g. malware or spyware seeking to widen access after initial foothold). Note one inconsistency to weigh: the vector uses PR:N (no privileges) yet the attack presupposes a running sandboxed app on the host, so the real precondition is 'attacker can execute a sandboxed app locally,' which the AV:L + UI:R metrics capture even though PR is scored N. No key data conflicts otherwise; patch availability is confirmed by Apple. |
| Exploit ScenarioDerived | A user installs or runs a malicious or compromised sandboxed application on an Apple device; the app abuses the improper authorization state to bypass the sandbox boundary and read credentials, keys, or tokens stored in the System Keychain that it should not be able to reach. No public exploit code is known, and the attack requires local execution of the rogue app rather than remote delivery. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
A sandboxed application running on Apple iOS/iPadOS, macOS Golden Gate, tvOS, visionOS, or watchOS can bypass authorization checks and read contents of the System Keychain, exposing stored secrets such as credentials, certificates, and tokens. The flaw stems from incorrect authorization combined with faulty state management (CWE-863) and affects all versions prior to the 27 release train; the platform owner has shipped fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 5.5) is consistent with our independent assessment: this is a genuine but locally-scoped access-control defect that requires an attacker to get a sandboxed app onto the device and have the user launch it (UI:R), so it cannot be triggered remotely over the network. EPSS is 0.16% (6th percentile) and no public exploit code has been identified at time of analysis, with no CISA KEV listing - impact is limited to confidentiality (keychain disclosure) with no integrity or availability effect, and patched 27-or-newer systems are not exposed.
RemediationAI
Vendor-released patch: iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 - update every affected device to these releases or later, using Settings > General > Software Update on iOS/iPadOS/tvOS/watchOS and System Settings > General > Software Update on macOS, or push the updates through MDM/Apple Business Manager for managed fleets, and reference the Apple advisories at https://support.apple.com/en-us/149034 through https://support.apple.com/en-us/149035, 149036, 149037, and 149038 for the per-platform detail. There is no user-configurable toggle that denies sandboxed apps access to the System Keychain, so there is no true workaround; the only genuine fix is upgrading, and administrators should treat unpatched devices as capable of leaking keychain secrets to any app the user installs. Compensating controls while patching is pending, each with clear trade-offs: restrict installation to vetted sources and disable sideloading/enterprise app installation on managed devices (reduces exposure but does not eliminate it, since the flaw is reachable from any sandboxed app including curated ones, and it adds friction for legitimate internal apps); apply MDM profiles that limit which apps can be installed and monitor for unexpected app deployments (partial mitigation, no user-visible downside beyond policy management overhead); and, for high-value secrets, rotate or migrate long-lived credentials out of the System Keychain where the platform allows, or re-issue them after patching, because any secret that was resident on an unpatched device during the exposure window should be considered potentially disclosed. Given the local-only vector (AV:L), no privileges required (PR:N), required user interaction (UI:R), and the absence of any public exploit or KEV entry, patching on the normal update cadence is proportionate for most environments, with expedited handling reserved for devices holding high-value keychain material.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying issue is an authorization-boundary failure in the platform's keychain access-control logic, classified as CWE-863 (Incorrect Authorization) and addressed by Apple through 'improved state management' - meaning the flawed check depended on state that a sandboxed process could influence or observe, allowing it to be evaluated incorrectly and to succeed where it should have been denied. The System Keychain is the OS-level keychain that normally sits outside the reach of third-party sandboxed apps; sandboxed processes are expected to be confined to their own containerized keychain and are gated by entitlements plus the sandbox profile. When the authorization state is mishandled, a sandboxed app can cross that boundary and read System Keychain items. The attack surface is strictly local: the CVSS vector shows AV:L (local) with UI:R (user interaction) and PR:N (no privileges required), so exploitation presupposes a sandboxed app already executing on the host device and a user who installs or launches it. There is no network vector and no server-side component, and the affected CPE entries cover apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, i.e. the entire consumer OS family sharing the keychain implementation. Because the bug is confined to confidentiality (C:H) with no integrity or availability impact, the practical exposure is disclosure of keychain secrets to an app that would not ordinarily be permitted to see them.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local malicious sandboxed app (AV:L, UI:R) with no prior privileges (PR:N) reads System Keychain secrets, so C:H but no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to access the System Keychain.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB