EUVD-2026-78030
GHSA-6pg9-xw5h-jfj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker delivers malicious app to macOS host
-
ExploitUser installs and runs the app
-
ExecutionApp triggers authentication defect
-
ImpactSystem-wide unexpected termination (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or crafted application to be present and executing on the target macOS system (macOS before 15.8, before 26.6, or before 27); this is a local, app-context precondition rather than remote network reach. Impact is limited to unexpected system termination (denial of service) - there is no confidentiality or integrity impact, no privilege gain, and no code execution. Limiting factors: attacker must first get their app onto and running on the host (social engineering, sideloading, or an already-compromised app), and updated macOS builds are patched. |
| Impact | This is a moderate-real-risk but not urgent issue. The vendor CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is inflated by an AV:N/PR:N choice that conflicts with the description: 'An app may be able to cause unexpected system termination' clearly implies a locally-installed, already-running application, not a remote unauthenticated network attacker. A more honest vector is local, app-privileged, availability-only (A:H for a full system crash), which lowers real severity to the mid-4 range. All exploitation signals point to low priority: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code is identified. SSVC framing: exploitation status is 'none', technical impact is limited to availability (system termination / DoS - no code execution, no data disclosure, no integrity loss), and automatability is low because it requires a malicious app already present on the host. Net: a legitimate patch-in-normal-cycle item, not an emergency - the CVSS-vs-description mismatch on attack vector is the key thing to verify with Apple. |
| Exploit ScenarioDerived | A user is convinced to install or run a malicious/crafted application on macOS; the app triggers the authentication flaw and forces an unexpected system termination (kernel panic / reboot), denying availability. No public exploit code exists and there is no evidence of active exploitation; impact is limited to crashing the machine, with no data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Unexpected system termination (denial of service) can be induced on Apple macOS by a malicious or crafted application running on the host, with the underlying cause classified as an improper authentication weakness (CWE-287) that Apple addressed through improved authentication logic. Affected builds are macOS Sequoia before 15.8, macOS Tahoe before 26.6, and macOS Golden Gate before 27; the independent assessment recalibrates the vendor's network-oriented vector to a local one (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must first get code executing on the machine - no remote path, no privilege gain, no confidentiality or integrity loss, and no code execution beyond the crash. Exploitation requires both local access and a running malicious app, so practical risk is moderate rather than urgent: no public exploit code has been identified at time of analysis, EPSS is only 0.20% (10th percentile), and vendor-released patches (15.8, 26.6, 27) are available, though the CVE is tracked in the Apple/ENISA ecosystem (EUVD-2026-78030) and tagged as an authentication-bypass class issue.
RemediationAI
Apply the vendor-released patches: update to macOS Sequoia 15.8, macOS Tahoe 26.6, or macOS Golden Gate 27 as appropriate for the installed release train - Apple advisories https://support.apple.com/en-us/128067, https://support.apple.com/en-us/149035, and https://support.apple.com/en-us/149043 document the fixes, and patch availability is confirmed by the vendor. Because exploitation requires a malicious or crafted app already executing locally, prior to patching the most effective compensating controls are application-execution controls rather than network filtering: enforce Gatekeeper and notarization, disable or tightly restrict sideloading of unsigned apps, and use MDM configuration profiles to allow-list only approved applications (trade-off: blocks legitimate ad-hoc and in-house software, so allow-list exceptions must be managed); restrict local login and interactive access to trusted users and remove unnecessary local accounts or admin rights on shared hosts (trade-off: operational friction for help-desk and lab machines); and monitor for repeated unexpected system terminations or crash loops originating from a single app bundle as an indicator of attempted exploitation (trade-off: crash telemetry noise and storage overhead). No network-perimeter mitigation exists for this issue, since the trigger path is a locally running application rather than a remotely exposed service, and the independent assessment notes the impact is limited to denial of service with no confidentiality, integrity, or privilege-escalation consequence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-287 (Improper Authentication): a component of macOS that relies on an authentication or authorization check can be driven into an inconsistent state by a local application, and the failure mode manifests as an unexpected system termination rather than a data compromise. Apple's description states the issue was addressed with improved authentication, which points to a logical validation gap (for example, a system service or inter-process trust check accepting a request it should have rejected) rather than a memory-safety bug - consistent with CWE-287 and with an impact limited to availability (C:N/I:N/A:H). Apple's published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which would imply an unauthenticated network trigger, but the independent assessment lowers this to AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H because the description explicitly scopes the trigger to a locally executing app and the crash is a system-termination effect. CPE data (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) confirms this is a platform-level macOS issue spanning the Sequoia, Tahoe, and Golden Gate release trains rather than a single bundled application, and the affected-version data (0 < 15.8, 0 < 26.6, 0 < 27) shows the fix is delivered as part of routine OS updates rather than as a standalone component patch.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A malicious app must run locally (AV:L, PR:L), contradicting the vendor's AV:N/PR:N; impact is a full system crash so A:H, with no C/I impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
Executive ViewAI
Apple macOS versions prior to Sequoia 15.8, Tahoe 26.6, and Golden Gate 27 contain a locally exploitable denial-of-service vulnerability that can crash affected systems, disrupting availability for end users. An authenticated local application can trigger the crash, but there is no remote vector, no privilege escalation, and no confidentiality or integrity loss; no public exploit identified at time of analysis. Leadership should care because unpatched macOS fleets running untrusted or malicious apps could experience localized availability incidents, though vendor patches are available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB