CVE-2026-43672: Apple macOS Authorization Bypass Vulnerability

CVE-2026-43672 Overview

CVE-2026-43672 is an authorization vulnerability in Apple macOS that allows a malicious application to bypass Privacy preferences. The flaw stems from improper state management in the authorization logic and is tracked under CWE-863: Incorrect Authorization. Apple addressed the issue in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Successful exploitation requires local access and user interaction, but grants an attacker the ability to read sensitive user data and modify protected resources without triggering the expected Transparency, Consent, and Control (TCC) prompts.

Critical Impact
A local malicious application can bypass macOS Privacy preferences to access protected resources such as Camera, Microphone, Contacts, Calendar, Photos, and Full Disk Access without user consent.

Affected Products

Apple macOS Sequoia versions prior to 15.7.8
Apple macOS Sonoma versions prior to 14.8.8
Apple macOS Tahoe versions prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43672 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-43672

Vulnerability Analysis

The vulnerability resides in the authorization logic that enforces macOS Privacy preferences, commonly implemented by the Transparency, Consent, and Control (TCC) subsystem. TCC gatekeeps access to sensitive resources such as the camera, microphone, contacts, location, and protected file system paths. A malicious application running locally can manipulate the authorization state to obtain access that the user never granted.

Exploitation requires local code execution and user interaction, per the CVSS vector AV:L/AC:L/PR:N/UI:R. The impact is high on confidentiality and integrity because bypassing TCC exposes user data and permits modification of protected resources. Availability is not affected.

Root Cause

Apple's advisory states the issue was addressed with improved state management. The root cause is inconsistent tracking of authorization decisions across the request lifecycle. When state is not correctly maintained between the authorization check and the resource access, a race or reuse condition permits an application to act on stale or attacker-influenced authorization state and skip the consent prompt.

Attack Vector

An attacker delivers a malicious application to the target system through phishing, a trojanized installer, or a supply chain vector. The user launches the application, satisfying the user interaction requirement. Once running, the application invokes the vulnerable authorization path to reach TCC-protected APIs, obtaining data or performing actions that Privacy preferences should have blocked.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.116%, reflecting a low predicted probability of exploitation in the near term.

Detection Methods for CVE-2026-43672

Indicators of Compromise

Modifications to the user TCC database at ~/Library/Application Support/com.apple.TCC/TCC.db or the system database at /Library/Application Support/com.apple.TCC/TCC.db that do not correlate with a user-issued consent prompt.
Unsigned or ad-hoc signed applications reading from protected directories such as ~/Library/Messages, ~/Library/Mail, or ~/Pictures without recorded TCC grants.
Processes accessing the camera or microphone with no corresponding entries in tccd log activity.

Detection Strategies

Monitor Endpoint Security Framework events ES_EVENT_TYPE_NOTIFY_ACCESS and ES_EVENT_TYPE_AUTH_OPEN targeting TCC-protected paths from processes without matching authorization records.
Correlate tccd unified log entries with process execution telemetry to identify resource access that bypassed the consent flow.
Establish baseline TCC.db state and alert on out-of-band writes performed by processes other than tccd.

Monitoring Recommendations

Ingest macOS unified logs and Endpoint Security telemetry into a centralized analytics platform for retrospective hunting.
Alert on newly installed applications that immediately request or access high-sensitivity resources such as Full Disk Access, camera, or microphone.
Track macOS build versions across the fleet and flag endpoints running versions prior to 15.7.8, 14.8.8, or 26.6.

How to Mitigate CVE-2026-43672

Immediate Actions Required

Update all macOS endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as applicable.
Audit currently installed applications on managed Macs and remove untrusted or unsigned software.
Review the TCC database on each endpoint to confirm that granted permissions match user expectations.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. See the vendor advisories: Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072. Deploy the updates through Apple Software Update, MDM, or approved patch management tooling.

Workarounds

Enforce Gatekeeper and require notarized applications through MDM policy to reduce the likelihood of executing a malicious binary.
Restrict installation privileges so standard users cannot install arbitrary applications from outside the App Store or approved sources.
Apply an MDM configuration profile using Privacy Preferences Policy Control (PPPC) payloads to explicitly deny sensitive TCC entitlements to non-approved bundle identifiers.

bash

# Verify the installed macOS version meets the patched baseline
sw_vers -productVersion

# Deploy the update on a managed endpoint
sudo softwareupdate --install --all --restart