What is the CVSS score of EUVD-2026-78128?

EUVD-2026-78128 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by EUVD-2026-78128?

A privilege-escalation flaw in macOS (all versions prior to 27 'Golden Gate') allows a locally run application to obtain full root control of the machine, exposing any affected Mac to complete…. A patch is available.

How to fix or mitigate EUVD-2026-78128?

Within 24 hours, confirm the macOS version inventory across the estate and identify which endpoints are running releases below macOS 27 'Golden Gate'; notify IT and security operations of the exposure and reinforce existing guidance that users only install software from trusted sources or the managed software catalogue. Within 7 days, begin staged deployment of the vendor-released patch (macOS Golden Gate 27) to the highest-risk populations first - executives, IT administrators, developers, and any Mac with privileged or production credentials - validating compatibility of critical business applications before broad rollout. Within 30 days, complete upgrade of all remaining supported macOS endpoints to macOS Golden Gate 27 or later, verify compliance through the endpoint management console, and document any devices that cannot be patched, restricting local application installation on those systems until they are remediated.

Apple EUVD-2026-78128

| CVE-2026-84631 HIGH

Improper Handling of Insufficient Permissions or Privileges (CWE-280)

2026-09-14 apple

GHSA-w8q9-p5c9-x72g

Information Disclosure Apple

7.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 10:36 vuln.today

CVSS changed

Sep 14, 2026 - 23:22 NVD

7.8 (HIGH)

Patch available

Sep 14, 2026 - 22:19 EUVD

CVE Published

Sep 14, 2026 - 20:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 14, 2026 - 20:51 cve.org

HIGH 7.8

DescriptionCVE.org

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

AnalysisAI

Local applications on macOS versions prior to 27 can escalate to root privileges because the operating system fails to properly validate entitlements before granting privileged operations (CWE-280). An attacker who can get a user to launch — or who can otherwise run — a crafted app on the target Mac gains full root-level control of the system, with high impact to confidentiality, integrity, and availability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, confirm the macOS version inventory across the estate and identify which endpoints are running releases below macOS 27 'Golden Gate'; notify IT and security operations of the exposure and reinforce existing guidance that users only install software from trusted sources or the managed software catalogue. …

Threat intelligence, references, and detailed analysis are available after sign-in.