CVE-2026-65362: Apple macOS Privilege Escalation Vulnerability

CVE-2026-65362 Overview

CVE-2026-65362 is a local privilege escalation vulnerability in Apple macOS. An application running on an affected system can exploit improper access control [CWE-284] to gain root privileges. Apple addressed the issue with improved checks in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The flaw requires local access and low privileges, but no user interaction. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the target host. The vulnerability affects the operating system directly, making it a useful post-compromise tool for adversaries seeking full system control.

Critical Impact
A local application can escalate to root, bypassing macOS access controls and taking full control of the affected system.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-65362 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65362

Vulnerability Analysis

CVE-2026-65362 is a local privilege escalation issue in macOS. The advisory from Apple states the flaw was resolved through improved checks, indicating that the affected component performed insufficient validation before granting elevated access. An application executing with standard user privileges can leverage the weakness to obtain root.

The vulnerability is classified under [CWE-284] Improper Access Control. This category covers cases where a component fails to properly restrict access to a resource from an unauthorized actor. In this instance, the missing or weak checks allow a local application to cross a privilege boundary.

Apple has not disclosed the specific subsystem affected or the technical mechanics of exploitation. The three separate advisories cover the fixes shipped in each supported macOS release train.

Root Cause

The root cause is insufficient validation within a macOS component that grants privileged access. Apple's fix description, "addressed with improved checks," indicates the pre-patch code path accepted requests or state without adequately verifying the caller's authorization or input constraints. This gap permits a local process to reach a code path reserved for privileged operations.

Attack Vector

An attacker requires local code execution on the target macOS system as an unprivileged or standard user. This foothold is typically achieved through phishing payloads, trojanized applications, or a prior remote code execution vulnerability. The attacker then runs a crafted application that triggers the vulnerable code path and elevates to root.

No user interaction is required beyond the initial execution of the malicious application. Once root is obtained, the attacker can disable security controls, install persistent implants, access protected files, and pivot within the environment. Apple has not published proof-of-concept code, and no public exploit is currently available.

See the Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor details.

Detection Methods for CVE-2026-65362

Indicators of Compromise

Unexpected processes running as root that were spawned from user-writable directories such as /Users/, /tmp/, or /private/tmp/.
New or modified LaunchDaemons in /Library/LaunchDaemons/ or /System/Library/LaunchDaemons/ created after a suspicious application launch.
Unsigned or ad-hoc signed binaries executing with elevated entitlements shortly after user-level process activity.

Detection Strategies

Monitor for parent-child process anomalies where a standard-user process is followed by activity attributed to root or uid=0.
Alert on modifications to protected directories, TCC databases, or SIP-protected paths originating from non-system processes.
Correlate application execution telemetry with subsequent privilege transitions to surface potential exploitation chains.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework (ESF) telemetry into centralized logging to retain process, file, and authentication events.
Track installation of new persistence mechanisms including launch agents, daemons, and kernel extensions.
Review audit logs for AUE_SETUID, AUE_SETREUID, and related privilege-changing syscalls invoked by non-system binaries.

How to Mitigate CVE-2026-65362

Immediate Actions Required

Update all Apple macOS systems to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 depending on the release train in use.
Inventory macOS endpoints and prioritize patching systems used by administrators or those with access to sensitive data.
Restrict installation of untrusted applications through Gatekeeper policy and mobile device management (MDM) enforcement.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Details are available in Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Deploy patches through Software Update or your MDM platform.

Workarounds

No official workaround has been published by Apple; patching is the required remediation.
Limit local user privileges and enforce least-privilege application installation policies to reduce attack surface.
Enable System Integrity Protection (SIP) and Gatekeeper, and audit exceptions granted to third-party software.

bash

# Verify the installed macOS version meets the patched release
sw_vers -productVersion

# Trigger a macOS software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart