CVE-2026-43775: Apple macOS Authorization Bypass Vulnerability

CVE-2026-43775 Overview

CVE-2026-43775 is an authorization vulnerability in Apple macOS that allows a local application to access sensitive user data. Apple addressed the issue with improved state management in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. The weakness is classified under [CWE-285] Improper Authorization. Exploitation requires local access and user interaction, and no public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A malicious or compromised application running on an affected macOS system can bypass authorization controls to read sensitive user data without appropriate privileges.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Tahoe prior to 26.6
Applications relying on the affected authorization state for user data isolation

Discovery Timeline

2026-07-27 - CVE-2026-43775 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43775

Vulnerability Analysis

CVE-2026-43775 stems from improper authorization enforcement in a macOS component that governs access to sensitive user data. The affected code path did not correctly track authorization state across operations, permitting an application to reach protected data without holding the required entitlement or user consent. Apple describes the remediation as improved state management, indicating the flaw resided in how transitions between authorized and unauthorized states were recorded and evaluated.

The issue maps to [CWE-285] Improper Authorization. Access decisions relied on transient or reusable state, which an app could influence to obtain a favorable authorization outcome. Successful exploitation exposes user data confidentiality but does not modify data or affect availability.

Root Cause

The root cause is inconsistent authorization state tracking within a privileged macOS subsystem. Access checks either occurred at the wrong point in the request lifecycle or trusted state that a caller could manipulate. As a result, an app could reach a code path that returned sensitive user data despite lacking the correct authorization.

Attack Vector

Exploitation requires local code execution on the target Mac and user interaction, such as launching a crafted application or approving a benign-looking prompt. The attacker does not need prior privileges. Once running, the malicious app interacts with the vulnerable component to obtain user data that macOS's Transparency, Consent, and Control (TCC) model or entitlement checks would normally restrict. Refer to Apple Support Article 128067 and Apple Support Article 128071 for Apple's advisory content.

Detection Methods for CVE-2026-43775

Indicators of Compromise

Unsigned or ad-hoc signed applications making requests to system services that handle sensitive user data such as contacts, photos, calendars, or location
Unexpected tccd and privacy-related daemon log entries showing access grants for apps without documented entitlements
New launch agents or launch daemons in ~/Library/LaunchAgents or /Library/LaunchAgents associated with unknown developer identifiers

Detection Strategies

Inventory endpoints running macOS Sequoia earlier than 15.7.8 and macOS Tahoe earlier than 26.6 and prioritize them for patching
Baseline expected access patterns to protected user data stores and alert on deviations from unsigned or newly installed applications
Correlate process execution telemetry with subsequent reads of privacy-protected paths under ~/Library to identify anomalous data access chains

Monitoring Recommendations

Ingest Unified Log entries from tccd, sandboxd, and syspolicyd into a central analytics platform for continuous review
Monitor Gatekeeper and XProtect events for applications gaining privacy access shortly after first execution
Track macOS version and build reporting across the fleet to confirm patch deployment status

How to Mitigate CVE-2026-43775

Immediate Actions Required

Deploy macOS Sequoia 15.7.8 or macOS Tahoe 26.6 to all affected endpoints through your MDM or Software Update workflow
Restrict installation of unsigned or non-notarized applications using Gatekeeper policy and application allowlisting
Review privacy permissions under System Settings and revoke access for applications that do not require it

Patch Information

Apple released fixes in macOS Sequoia 15.7.8 and macOS Tahoe 26.6 by improving state management in the affected authorization path. Details are documented in Apple Support Article 128067 and Apple Support Article 128071. Apply these updates on all supported Macs to eliminate the vulnerability.

Workarounds

No vendor-supplied workaround exists; upgrading to the patched macOS releases is the only complete mitigation
Limit user privileges and enforce application allowlisting to reduce the likelihood of a malicious app being executed locally
Enable Full Disk Access and privacy access reviews as part of routine endpoint hygiene

bash

# Verify current macOS build and trigger available updates on managed Macs
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all --restart