CVE-2026-43723 Overview
CVE-2026-43723 is a path handling vulnerability affecting multiple Apple operating systems. The flaw allows a local application to gain root privileges by exploiting improper validation of file paths. Apple addressed the issue with improved validation logic across its platform portfolio.
The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Successful exploitation gives an attacker full control over the affected device with root-level access to files, processes, and system configuration.
Critical Impact
A malicious app installed on an affected Apple device can escalate to root privileges, bypassing sandbox restrictions and compromising the operating system.
Affected Products
- Apple iOS and iPadOS (fixed in iOS 26.6 and iPadOS 26.6)
- Apple macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6
- Apple tvOS 26.6, visionOS 26.6, and watchOS 26.6
Discovery Timeline
- 2026-07-27 - CVE-2026-43723 published to the National Vulnerability Database
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-43723
Vulnerability Analysis
CVE-2026-43723 is a path traversal weakness rooted in insufficient validation of file paths supplied to a privileged component. When a local application constructs a path containing traversal sequences or symbolic references, the affected code resolves the path without adequate sanitization. This allows the app to influence file system operations executed with elevated permissions.
Because the flaw is exposed to unprivileged local processes, any installed app on iOS, iPadOS, macOS, tvOS, visionOS, or watchOS can act as the attack surface. The outcome is a break of the confidentiality, integrity, and availability boundaries enforced by the app sandbox.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. A privileged Apple component accepted attacker-controlled path input and resolved it against sensitive system locations without normalizing traversal characters or validating the final target. Apple's fix introduces stricter validation to reject unsafe path components before they reach privileged operations.
Attack Vector
The attack requires local access with low privileges and no user interaction. An attacker delivers a malicious application to the target device through the App Store, TestFlight, sideloading, or an already-compromised app. Once running, the app issues crafted path arguments to the vulnerable code path and gains root privileges. From there, the attacker can persist, disable security controls, and access data belonging to other apps and the operating system itself.
No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS score is 0.149%, reflecting a low predicted probability of exploitation activity in the near term.
See the Apple Security Update 128066 advisory for vendor-provided technical context.
Detection Methods for CVE-2026-43723
Indicators of Compromise
- Unexpected processes running with root or system entitlements shortly after a new app installation or update.
- Suspicious file writes to protected paths such as /System, /Library/LaunchDaemons, or SIP-protected directories on macOS.
- Applications invoking privileged XPC services with unusual path arguments containing .. traversal sequences or symlink references.
- Newly created launch daemons, kernel extensions, or configuration profiles without a corresponding admin action.
Detection Strategies
- Monitor Endpoint Security framework events on macOS for ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_OPEN, and ES_EVENT_TYPE_NOTIFY_RENAME involving protected paths.
- Correlate app installation events with subsequent privilege transitions to root within short time windows.
- Baseline expected XPC and helper tool behavior, then flag anomalous path arguments or entitlement usage.
Monitoring Recommendations
- Ingest unified log data from macOS endpoints into a centralized analytics platform for retrospective hunting.
- Track OS build and version telemetry to identify devices that remain on vulnerable releases.
- Alert on the creation or modification of persistence artifacts including LaunchAgents, LaunchDaemons, and login items from non-standard installers.
How to Mitigate CVE-2026-43723
Immediate Actions Required
- Update all Apple devices to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6.
- Inventory managed Apple endpoints through MDM to confirm patch deployment status.
- Restrict installation of unvetted applications, especially on macOS systems that allow sideloaded or notarization-bypassed binaries.
- Review third-party helper tools and privileged services for unusual activity following patch rollout.
Patch Information
Apple has released fixes across its platform lineup. Refer to the vendor advisories for build numbers and installation guidance: Apple Security Update 128066, 128067, 128068, 128069, 128070, 128071, and 128072.
Workarounds
- No official workaround exists; patching is the only supported remediation.
- Reduce exposure by limiting app installation to trusted, notarized sources and enforcing MDM-based app allowlists.
- Enable System Integrity Protection (SIP) and Gatekeeper on macOS, and avoid disabling security controls for troubleshooting.
# Verify current macOS version and confirm patch level
sw_vers
softwareupdate --list
softwareupdate --install --all --restart
# Confirm SIP status on macOS
csrutil status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
