CVE-2026-65356: macOS Authentication Bypass Vulnerability

CVE-2026-65356 Overview

CVE-2026-65356 is an access control vulnerability affecting multiple versions of Apple macOS. The flaw allows a local application to access sensitive user data that should be restricted by the operating system's permission model. Apple addressed the issue through improved access controls in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The weakness is categorized under [CWE-284] Improper Access Control. Local, low-privileged processes can abuse the condition without user interaction, making it relevant for post-compromise scenarios where an attacker has already executed code on the host.

Critical Impact
A malicious or compromised application running locally on an unpatched macOS system can read sensitive user data, bypassing Apple's privacy and access control protections.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-10-20 - CVE-2026-65356 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-65356

Vulnerability Analysis

The vulnerability resides in a macOS access control check that failed to adequately restrict application access to sensitive user data. An application running with standard, unprivileged permissions can reach data paths that should require explicit user consent or elevated entitlements. Apple's advisory describes the fix as the introduction of improved access controls, confirming the root cause was a permission enforcement gap rather than a memory safety flaw. Exploitation does not require user interaction, which increases its utility inside multi-stage attack chains that follow initial access through phishing, malicious installers, or supply chain compromise.

Root Cause

The root cause is improper access control [CWE-284] in a macOS subsystem that mediates application access to protected resources. The affected component did not sufficiently validate the caller's authorization before returning sensitive user data. Apple's remediation applies stricter authorization checks on the affected code path across macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

Attack Vector

The attack vector is local. A threat actor must first deliver and execute an application on the target macOS host, for example through social engineering, trojanized software, or chained exploitation. Once running, the application invokes the vulnerable interface to read sensitive user data without triggering the expected privacy prompt or permission denial. Confidentiality is affected while integrity and availability remain intact, consistent with an information disclosure outcome.

Apple has not published exploitation details, and no public proof-of-concept has been released. Readers should consult the vendor advisories for component-level technical references: Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043.

Detection Methods for CVE-2026-65356

Indicators of Compromise

No vendor-published indicators of compromise are associated with CVE-2026-65356 at this time.
Unexpected access attempts to protected user data directories such as ~/Library, Contacts, Calendars, or Photos stores by non-sanctioned processes.
Applications bypassing TCC (Transparency, Consent, and Control) prompts when accessing privacy-protected resources.

Detection Strategies

Monitor endpoint telemetry for processes that read sensitive user data without a corresponding TCC authorization event.
Baseline normal application behavior and alert on new or unsigned binaries invoking privacy-sensitive APIs.
Correlate process execution events with file access events targeting user data stores to surface unauthorized reads.

Monitoring Recommendations

Collect macOS Endpoint Security Framework (ESF) telemetry including ES_EVENT_TYPE_NOTIFY_OPEN and TCC-related events into a central SIEM.
Track macOS build versions across the fleet and alert on hosts running versions below macOS Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.
Review application inventory for unsigned, newly introduced, or unexpectedly privileged apps that may abuse the flaw.

How to Mitigate CVE-2026-65356

Immediate Actions Required

Apply Apple's security updates to upgrade affected systems to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7.
Inventory macOS endpoints and prioritize patching for devices that handle sensitive data such as developer workstations and executive laptops.
Restrict installation of unsigned or non-notarized applications through MDM policy.

Patch Information

Apple fixed CVE-2026-65356 in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Patch details and affected components are documented in Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043. Administrators should deploy these updates through Software Update, MDM, or Apple Business Manager.

Workarounds

No vendor-supplied workaround is available; applying the macOS update is the supported remediation.
Enforce least-privilege on user accounts and limit administrative rights to reduce the impact of a compromised application.
Use application allowlisting and Gatekeeper policies to prevent execution of untrusted binaries on unpatched hosts.

bash

# Verify installed macOS version and apply pending updates
sw_vers -productVersion
sudo softwareupdate --list
sudo softwareupdate --install --all --restart