CVE-2026-43691 Overview
CVE-2026-43691 is a path handling vulnerability in Apple macOS that allows a local application to gain root privileges. The flaw is categorized as a path traversal weakness ([CWE-22]) and stems from insufficient validation of file paths within the operating system. Apple addressed the issue by improving path validation in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. An attacker with local access and low privileges can exploit the vulnerability to escalate to root, resulting in full compromise of confidentiality, integrity, and availability on affected systems.
Critical Impact
Successful exploitation grants root privileges on macOS, giving attackers complete control over the system, installed applications, and stored data.
Affected Products
- Apple macOS versions prior to Golden Gate 27
- Apple macOS versions prior to Sequoia 15.8
- Apple macOS versions prior to Tahoe 26.7
Discovery Timeline
- 2026-09-14 - CVE-2026-43691 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-43691
Vulnerability Analysis
CVE-2026-43691 arises from a path handling issue in macOS. The operating system fails to properly validate file paths before performing privileged operations. A local app can craft path inputs that the system resolves in an unintended location, allowing operations to occur outside intended directory boundaries. This condition falls under [CWE-22], improper limitation of a pathname to a restricted directory.
Because the affected code paths run with elevated privileges, an attacker who controls path input can leverage the flaw to write, replace, or execute files in locations reserved for root. The result is a privilege escalation from a standard user context to full root access. Apple resolved the weakness through improved input validation and stricter path canonicalization.
Root Cause
The vulnerability originates in code that consumes attacker-influenced path data without normalizing or verifying that the resolved path stays within an approved directory. Missing canonicalization allows traversal sequences and symbolic link manipulation to redirect privileged file operations to attacker-controlled targets.
Attack Vector
Exploitation requires local access and low-privileged code execution on the target system. No user interaction is required. An attacker delivers or runs a malicious application under a standard account, then triggers the vulnerable code path to obtain root. Public proof-of-concept code is not available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor technical details.
Detection Methods for CVE-2026-43691
Indicators of Compromise
- Unexpected setuid or root-owned files appearing in user-writable directories such as /tmp, /var/tmp, or user home directories.
- Newly created or modified LaunchDaemons or LaunchAgents plist files under /Library/LaunchDaemons associated with unsigned or unfamiliar binaries.
- Symbolic links pointing from user-controlled paths into system-protected directories.
- Processes spawned by unprivileged apps that subsequently execute as root without a legitimate authorization prompt.
Detection Strategies
- Monitor process execution telemetry for unprivileged parent processes spawning privileged child processes on macOS endpoints.
- Alert on file writes to system directories such as /Library, /System, and /usr/local originating from user-space applications.
- Correlate symbolic link creation events with subsequent privileged file operations targeting the same paths.
Monitoring Recommendations
- Ingest Apple Endpoint Security Framework (ESF) events into your SIEM to capture process, file, and authorization telemetry.
- Track installation of unsigned or ad-hoc-signed applications on managed macOS fleets.
- Baseline expected root-privileged operations per host and alert on deviations, especially from newly installed applications.
How to Mitigate CVE-2026-43691
Immediate Actions Required
- Upgrade affected macOS endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as appropriate for each device.
- Inventory macOS assets and identify systems running vulnerable versions using mobile device management (MDM) reporting.
- Restrict installation of untrusted applications through Gatekeeper policies and MDM configuration profiles.
- Review recent local privilege escalation telemetry on macOS hosts for signs of prior exploitation.
Patch Information
Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Patch details are documented in Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Apply the vendor update matching the macOS release train deployed in your environment.
Workarounds
- No official vendor workaround is available; apply the security update as the primary remediation.
- Enforce least-privilege access and prevent standard users from installing unvetted applications until patches are deployed.
- Enable System Integrity Protection (SIP) and verify it remains active on all managed macOS endpoints.
# Verify installed macOS version and confirm patch level
sw_vers -productVersion
# Check System Integrity Protection status
csrutil status
# Trigger software update check via command line
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
