CVE-2026-65361: Apple macOS Information Disclosure Flaw

CVE-2026-65361 Overview

CVE-2026-65361 is an access control weakness in Apple macOS that allows a local application to access sensitive user data. Apple addressed the issue with improved checks across macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The flaw is classified under [CWE-284] (Improper Access Control) and requires local, low-privileged access to the target system without any user interaction. Exploitation results in confidentiality impact only, with no reported effect on integrity or availability.

Critical Impact
A malicious or compromised local application can read sensitive user data that should be protected by macOS access controls, enabling downstream credential theft or privacy violations.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-65361 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-65361

Vulnerability Analysis

CVE-2026-65361 stems from insufficient access control checks within macOS. Apple's advisory states the issue was addressed with improved checks, indicating that a code path failed to properly validate whether a caller was authorized to access protected user data. Apple has published fix details in Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043.

The attack surface is limited to local applications already running on the system. An attacker cannot trigger the flaw remotely, and no user interaction is required beyond running the malicious application. Successful exploitation yields sensitive user data disclosure, which may include personal files, keychain-adjacent artifacts, or other data normally guarded by TCC (Transparency, Consent, and Control) style protections.

Root Cause

The root cause is improper access control [CWE-284]. A protected resource was reachable through a code path that did not enforce authorization decisions before returning data to the caller. Apple's remediation adds the missing validation logic rather than removing the underlying interface.

Attack Vector

An attacker must first achieve local code execution on the macOS host, typically by convincing a user to install a trojanized application or by leveraging a separate initial-access vector. Once running, the application invokes the affected macOS component and receives sensitive data that macOS access controls should have blocked. Because the vulnerability requires only low privileges and no user interaction, it is well-suited for use as a second-stage capability in a broader intrusion chain.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing exists for this CVE at the time of publication.

Detection Methods for CVE-2026-65361

Indicators of Compromise

Unsigned or newly installed applications accessing user data directories such as ~/Library, ~/Documents, or ~/Downloads outside their declared entitlements.
Processes making unexpected calls into system frameworks associated with the components patched in Apple Support Documents #149035, #149042, and #149043.
Anomalous read activity against files typically protected by macOS privacy controls without a corresponding TCC prompt.

Detection Strategies

Baseline application behavior and alert on binaries that suddenly begin enumerating or reading user data outside their normal access pattern.
Correlate execution of recently installed or non-notarized applications with sensitive file reads to surface potential exploitation.
Track codesign verification failures and Gatekeeper bypass events, which often precede local privacy abuse.

Monitoring Recommendations

Ingest macOS Endpoint Security telemetry (ES events for file_open, exec, and mmap) into your SIEM or data lake for retrospective hunting.
Monitor OS version fleet-wide and flag hosts still running macOS releases earlier than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.
Alert on process launches from writable user directories that subsequently touch privacy-protected resources.

How to Mitigate CVE-2026-65361

Immediate Actions Required

Apply the Apple security updates that ship with macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 across all managed endpoints.
Inventory macOS assets and prioritize patching for systems that store regulated or high-value user data.
Restrict installation of unsigned or non-notarized applications through MDM policy while patch deployment is in progress.

Patch Information

Apple has released patches in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for version-specific guidance and download links.

Workarounds

Limit local application installation to vetted, notarized software distributed via MDM or the Mac App Store.
Enforce least-privilege user accounts so that a compromised local application has minimal reachable user data.
Audit and tighten TCC permissions for third-party applications until patches are fully deployed.

bash

# Verify current macOS build and confirm it includes the fix
sw_vers
softwareupdate --list
sudo softwareupdate --install --all --restart