CVE-2026-43765: Apple macOS Privilege Escalation Flaw

CVE-2026-43765 Overview

CVE-2026-43765 is a symlink handling flaw in Apple macOS that allows a local application to modify protected parts of the file system. The issue was addressed with improved handling of symbolic links. Apple resolved the vulnerability in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The weakness is classified under CWE-59 (Improper Link Resolution Before File Access, also known as a symlink following vulnerability). Exploitation requires local access and user interaction, and successful abuse grants attackers write access to file system regions normally protected by System Integrity Protection (SIP).

Critical Impact
A local application can bypass file system protections and modify SIP-protected files, enabling persistence and integrity compromise on affected macOS systems.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43765 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43765

Vulnerability Analysis

CVE-2026-43765 arises from insufficient validation of symbolic links during file operations performed by a privileged macOS component. When the component follows a path that includes an attacker-controlled symlink, it writes to or modifies the target of the symlink rather than the intended file. The attacker points the symlink at a protected location such as a directory covered by System Integrity Protection. This turns a permitted write into an unauthorized modification of a protected resource.

The integrity impact is high, while confidentiality and availability are not directly affected. Exploitation requires the attacker to already run code locally on the host and requires user interaction, which limits remote scenarios. However, once a foothold exists, this class of flaw is a reliable stepping stone for tampering with system binaries, launch daemons, or configuration files that survive reboot.

Root Cause

The root cause is improper link resolution before file access ([CWE-59]). The vulnerable code path opens or writes to a path without ensuring that intermediate components are not symbolic links controlled by an unprivileged user. Apple's fix introduces improved symlink handling, likely using O_NOFOLLOW, openat with AT_SYMLINK_NOFOLLOW, or explicit resolution checks against the resolved real path.

Attack Vector

A local attacker plants a symbolic link in a directory writable by the current user, then triggers the privileged macOS operation that traverses that directory. The operation follows the symlink and performs its write against the linked target, which the attacker has aimed at a SIP-protected path. User interaction is required to invoke the vulnerable workflow. No verified public proof-of-concept exists at time of writing. Refer to the Apple Security Update Advisory #128067, Advisory #128071, and Advisory #128072 for vendor detail.

Detection Methods for CVE-2026-43765

Indicators of Compromise

Unexpected symbolic links created in user-writable directories that resolve to paths under /System, /usr, /Library, or other SIP-protected locations.
Modifications to files under SIP-protected directories on macOS versions prior to 15.7.8, 14.8.8, or 26.6.
New or altered launch daemons or property list files placed outside standard installer workflows.

Detection Strategies

Monitor symlink(), symlinkat(), and link() system calls originating from unprivileged processes that target sensitive parent directories.
Alert on file integrity changes to SIP-protected paths, since legitimate writes to these locations are rare outside of Apple software updates.
Correlate short-lived symlink creation followed by execution of a privileged helper binary within the same process lineage.

Monitoring Recommendations

Enable Endpoint Security framework telemetry (ES_EVENT_TYPE_NOTIFY_CREATE, ES_EVENT_TYPE_NOTIFY_LINK) and forward events to a central log store.
Track installed macOS build numbers across the fleet to flag hosts still running vulnerable versions.
Review Unified Log entries for privileged helpers writing to unexpected paths after user interaction with untrusted applications.

How to Mitigate CVE-2026-43765

Immediate Actions Required

Update all Apple macOS endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Restrict installation and execution of untrusted applications by enforcing Gatekeeper and notarization policies.
Audit endpoints for existing symbolic links pointing from user directories into SIP-protected locations.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Deployment guidance is available in Apple Security Update Advisory #128067, Advisory #128071, and Advisory #128072. Apply the update through Software Update or an MDM solution such as Jamf or Kandji.

Workarounds

No vendor-supplied workaround exists; patching is the supported remediation.
Limit local user privileges and remove standard users from the administrator group where feasible.
Block execution of unsigned or unknown applications through Gatekeeper policy to reduce the local attack surface.

bash

# Verify macOS build version on an endpoint
sw_vers -productVersion
sw_vers -buildVersion

# Confirm System Integrity Protection is enabled
csrutil status

# Trigger a software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart