CVE-2026-64723: Apple macOS Information Disclosure Flaw

CVE-2026-64723 Overview

CVE-2026-64723 is a logic flaw in Apple macOS that allows a local application to access sensitive user data. Apple addressed the issue with improved checks in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The vulnerability requires local access and user interaction, and results in confidentiality impact without affecting system integrity or availability. Apple assigned this issue [CWE-284: Improper Access Control]. No public exploit code is available, and the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A malicious application running locally on an unpatched macOS system can read sensitive user data that access controls should protect.

Affected Products

Apple macOS Sequoia versions prior to 15.7.8
Apple macOS Sonoma versions prior to 14.8.8
Apple macOS Tahoe versions prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-64723 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64723

Vulnerability Analysis

CVE-2026-64723 stems from a logic error in a macOS component that governs access to sensitive user data. Apple's advisory states that an app may be able to access sensitive user data due to insufficient checks in the affected code path. The issue is categorized under [CWE-284: Improper Access Control], indicating that the operating system fails to correctly enforce authorization before returning protected information to a caller.

Exploitation requires local access to the target system and some form of user interaction, such as launching a crafted application. The scope of the impact is limited to confidentiality; the vulnerability does not allow modification of data or disruption of service. Apple has not published exploit details, and no proof-of-concept code is publicly available.

Root Cause

The root cause is a missing or incorrect authorization check in a privileged code path. According to Apple, the issue was addressed with improved checks, indicating that the original implementation permitted an operation without fully validating the caller's entitlements or the sensitivity of the requested resource.

Attack Vector

An attacker must first deliver and execute an application on the target Mac. Once running, the application invokes the vulnerable API or subsystem to retrieve data that macOS access controls should have blocked. Because the flaw is local and user-assisted, initial delivery typically relies on social engineering, malicious installers, or supply-chain compromise of legitimate software.

See the Apple advisories for component-specific details: Apple Support Advisory #128067, Apple Support Advisory #128071, and Apple Support Advisory #128072.

Detection Methods for CVE-2026-64723

Indicators of Compromise

Unsigned or ad-hoc signed applications executing shortly after user download or email attachment activity.
Unexpected process access to protected directories such as ~/Library, ~/Documents, or TCC-protected locations.
macOS tccd log entries showing anomalous authorization decisions for previously unseen bundle identifiers.

Detection Strategies

Inventory macOS endpoints and flag any host running a build older than 15.7.8, 14.8.8, or 26.6.
Correlate application launches with subsequent reads of sensitive user files using endpoint telemetry.
Baseline entitlements and TCC prompts across the fleet to spot applications requesting unexpected access.

Monitoring Recommendations

Ship Endpoint Security framework events and unified log data to a centralized analytics platform for retrospective hunting.
Alert on newly executed binaries that access user data stores within a short window of first launch.
Track macOS version compliance continuously and generate tickets for hosts that fall behind on security updates.

How to Mitigate CVE-2026-64723

Immediate Actions Required

Upgrade affected systems to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as soon as feasible.
Restrict installation of applications from untrusted sources by enforcing Gatekeeper and notarization policies.
Audit macOS endpoints for outdated builds and prioritize remediation on systems that handle sensitive data.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Refer to Apple Support Advisory #128067, Apple Support Advisory #128071, and Apple Support Advisory #128072 for release-specific details and component identifiers.

Workarounds

No vendor-provided workaround exists; applying the security update is the only supported remediation.
Reduce risk by limiting local administrative privileges and blocking execution of unsigned applications through MDM policy.
Review TCC permissions granted to third-party applications and revoke access that is not operationally required.

bash

# Verify macOS build and check for available updates
sw_vers
softwareupdate --list
sudo softwareupdate --install --all --restart