CVE-2026-43758: Apple macOS Information Disclosure Flaw

CVE-2026-43758 Overview

CVE-2026-43758 is an authorization vulnerability affecting multiple Apple operating systems, including macOS and watchOS. The flaw stems from improper state management in an authorization check, allowing a locally installed application to access sensitive user data without proper consent. Apple has addressed the issue by improving state management within the affected component. The vulnerability is classified as an Information Exposure weakness [CWE-200] and requires local access with user interaction to exploit.

Critical Impact
A malicious application running on an affected device may bypass authorization checks and read sensitive user data, resulting in a confidentiality breach on the local system.

Affected Products

Apple macOS Sequoia (versions prior to 15.7.8)
Apple macOS Sonoma (versions prior to 14.8.8) and macOS Tahoe (versions prior to 26.6)
Apple watchOS (versions prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-43758 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in the NVD database

Technical Details for CVE-2026-43758

Vulnerability Analysis

CVE-2026-43758 is an authorization bypass caused by inconsistent state tracking within an Apple operating system component. When the affected code path evaluates whether a caller may access protected user data, its internal state can be manipulated so that authorization succeeds where it should have failed. The result is that an application running on the device can retrieve sensitive information without holding the necessary entitlement or user approval.

The issue is limited to local attack scenarios and requires user interaction, typically in the form of installing or launching a malicious or trojanized application. Once running, the app operates with normal user privileges but leverages the authorization flaw to read data outside its intended scope. Apple's advisory describes the fix as improved state management, indicating the patched code enforces consistent authorization state across the vulnerable operation.

Root Cause

The root cause is improper handling of authorization state [CWE-200]. Under specific sequences of operations, the component fails to keep its authorization decision consistent with the requested action, permitting sensitive data reads that should have been denied.

Attack Vector

Exploitation requires local code execution on the target device and user interaction. A user must run an application that invokes the vulnerable code path. There is no network-based attack vector, and no elevated privileges are required beyond those of a standard user process. Apple has not indicated public exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept has been published. Refer to the Apple Support Article 128067 and companion advisories for vendor-supplied technical context.

Detection Methods for CVE-2026-43758

Indicators of Compromise

Unexpected access to protected user data stores (Contacts, Calendars, Photos libraries, or TCC-protected directories) by applications that have not been granted those permissions.
Installation or execution of unsigned, ad-hoc signed, or newly notarized applications from untrusted developers shortly before anomalous data access events.
Processes reading sensitive user files outside their sandbox container without a corresponding TCC prompt in system logs.

Detection Strategies

Monitor macOS Endpoint Security events (ES_EVENT_TYPE_NOTIFY_OPEN, ES_EVENT_TYPE_NOTIFY_READDIR) for unusual reads of user data by non-privileged applications.
Correlate application execution telemetry with TCC database (TCC.db) state to identify data access that occurred without a corresponding authorization grant.
Alert on macOS and watchOS versions in the environment that fall below the patched builds (15.7.8, 14.8.8, 26.6).

Monitoring Recommendations

Maintain an accurate software inventory of Apple endpoints and continuously compare installed OS builds against Apple's patched versions.
Baseline normal application-to-data-store access patterns and alert on statistical deviations, particularly for newly installed or recently updated applications.
Review Unified Logs (log show --predicate 'subsystem == "com.apple.TCC"') for anomalous authorization decisions on affected hosts.

How to Mitigate CVE-2026-43758

Immediate Actions Required

Update all affected devices to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, or watchOS 26.6 as applicable.
Audit installed applications on managed Apple endpoints and remove any untrusted or unnecessary software that could serve as a delivery vehicle.
Verify TCC permissions granted to third-party applications and revoke access to sensitive categories where not required.

Patch Information

Apple released fixes across four security updates. Detailed version information is available in Apple Support Article 128067, Apple Support Article 128068, Apple Support Article 128071, and Apple Support Article 128072. Deploy the updates through Apple's built-in Software Update mechanism or via mobile device management (MDM) tooling.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Restrict installation of unvetted applications through MDM configuration profiles and Gatekeeper policies until patches are deployed.
Enforce least-privilege by limiting standard user accounts on macOS devices and disallowing installation of applications from unidentified developers.

bash

# Configuration example: verify the installed macOS build against the patched version
sw_vers -productVersion
# Expected output for patched Sequoia hosts: 15.7.8 (or later)
# Expected output for patched Sonoma hosts: 14.8.8 (or later)
# Expected output for patched Tahoe hosts:  26.6  (or later)

# Trigger the software update workflow
sudo softwareupdate --install --all --restart