CVE-2026-43760: Apple macOS Information Disclosure Issue

CVE-2026-43760 Overview

CVE-2026-43760 is an access control weakness in Apple macOS that allows an application to reach user-sensitive data it should not be able to read. Apple addressed the issue with improved access restrictions in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. The flaw is categorized under [CWE-284: Improper Access Control]. Public analysis from the reverse.put.as blog frames the underlying condition as pre-authentication reachable, aligning with the network attack vector reported by NVD.

Critical Impact
An application running on an unpatched macOS host can bypass access restrictions and read user-sensitive data without user interaction or prior privileges.

Affected Products

Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6
Systems running affected macOS builds with vulnerable component enabled

Discovery Timeline

2026-07-27 - CVE-2026-43760 published to the National Vulnerability Database
2026-07-29 - Technical write-up published at reverse.put.as ("It's a Pre-Auth, Stupid")
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-43760

Vulnerability Analysis

The vulnerability is an improper access control issue [CWE-284] in a macOS component. Apple's advisory states that "an app may be able to access user-sensitive data," indicating a bypass of the access restrictions that normally isolate user data from arbitrary applications. Apple's remediation notes describe the fix as "improved access restrictions," which points to missing or insufficient authorization checks in the affected code path.

According to the third-party analysis published on reverse.put.as, the reachable code path does not require prior authentication, which is consistent with the reported network attack vector and the lack of required privileges or user interaction. The confidentiality impact is high while integrity and availability impacts are low, reflecting a data-exposure primitive rather than full system compromise.

Root Cause

The root cause is missing or insufficient access enforcement on an interface that mediates access to user data. Because the access decision was not correctly gated, a caller could reach protected resources without satisfying the intended authorization requirements. Apple's patch reintroduces the missing checks.

Attack Vector

An attacker-controlled application, or a remote input that reaches the vulnerable component pre-authentication, invokes the exposed interface and retrieves user-sensitive data. Exploitation does not require elevated privileges or user interaction, which lowers the operational bar for use in follow-on attacks such as credential theft or reconnaissance.

No verified public exploit code is available. Refer to the Put.as Pre-Auth Analysis for the technical breakdown.

Detection Methods for CVE-2026-43760

Indicators of Compromise

Unexpected access to user data directories such as ~/Library/, Contacts, Calendar, or Keychain resources by non-standard applications
Unsigned or newly installed applications spawning processes that read TCC-protected paths
Outbound network connections from processes that immediately follow access to user data stores

Detection Strategies

Inventory macOS endpoints and flag hosts running builds earlier than macOS Sonoma 14.8.8 or macOS Tahoe 26.6
Baseline normal application access to user-sensitive locations and alert on deviations
Correlate process execution telemetry with file-open events targeting TCC-protected resources

Monitoring Recommendations

Ingest macOS Endpoint Security and unified log telemetry into a central analytics platform
Monitor tccd decisions and access denials for anomalies indicating probing activity
Track application code signatures and notarization status across the fleet to identify unauthorized binaries

How to Mitigate CVE-2026-43760

Immediate Actions Required

Update affected endpoints to macOS Sonoma 14.8.8 or macOS Tahoe 26.6 without delay
Restrict installation of untrusted applications through MDM policy and Gatekeeper enforcement
Audit third-party applications with access to sensitive user data and remove those that are unnecessary

Patch Information

Apple released fixes in macOS Sonoma 14.8.8 and macOS Tahoe 26.6. Refer to Apple Support Document 128067 and Apple Support Document 128072 for the official advisories and update instructions.

Workarounds

Apply MDM configuration profiles that limit which applications can request access to protected user data
Enforce least-privilege on user accounts and disable local administrator rights where feasible
Segment macOS hosts that handle sensitive data from untrusted networks until patches are deployed

bash

# Verify installed macOS version and apply available updates
sw_vers -productVersion
sudo softwareupdate --list
sudo softwareupdate --install --all --restart