Apple macOS EUVD-2026-78035

Exploitation requires the ability to execute a program locally on the target Mac under a standard (non-privileged) user account - the CVSS vector PR:L/UI:N confirms low privileges are sufficient and that no additional user interaction beyond launching the application is needed. The specific macOS feature or component whose access-control check is faulty is not named in the advisory, so defenders cannot restrict a single named facility; the practical precondition is untrusted local code execution on an unpatched system (macOS below 15.8, 26.7, or 27). Exploitation is limited by the absence of any remote vector - an attacker cannot reach this flaw over the network, must first land code on the host, and must defeat Gatekeeper/notarization prompts to introduce that code on default-configured systems. Fully patched machines, and deployments where managed Macs only run allowlisted notarized applications, are not exposed.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) describes a local, low-complexity attack requiring only low privileges and no user interaction beyond launching the application, with total confidentiality, integrity, and availability impact on the host. Those metrics are internally consistent and, importantly, CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no' - meaning there is no confirmed in-the-wild activity and no evidence that the step can be reliably automated at scale - while EPSS and KEV data are absent from the supplied intelligence. That combination makes this a genuine but post-compromise escalation primitive: it is only reachable after an attacker already has code execution as a local user, so it amplifies existing footholds rather than providing initial access. Consequently, a mid-sized operator such as a municipal IT team in boleslawiec should prioritise patching managed fleets but need not treat this as an emergency edge-facing exposure, since there is no remote vector and no confirmed exploitation; note additionally that EPSS and KEV status were not provided, so the real-world exploitation signal is incomplete rather than negative.

An attacker who already has a foothold on a Mac - for example through a malicious application, a trojanised installer, or a compromised user session - runs a crafted program that abuses the flawed access-control check to perform a privileged operation. Because the vector is AV:L/AC:L/PR:L/UI:N, the program needs no further interaction and no admin credentials once executing, and successful exploitation yields root, enabling persistence, disabling of security controls, and full read/write access to all user data on the host. No publicly available exploit code has been identified at time of analysis.