CVE-2026-65374 Overview
CVE-2026-65374 is a memory corruption vulnerability in Apple macOS that can be triggered when a user connects to a malicious WebDAV (Web Distributed Authoring and Versioning) server. Apple addressed the issue with improved validation in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. A successful exploit allows arbitrary code execution in the context of the connecting user. The weakness is classified as an out-of-bounds write [CWE-787].
Critical Impact
Connecting to an attacker-controlled WebDAV server can result in remote code execution on unpatched macOS systems.
Affected Products
- Apple macOS prior to Tahoe 26.7
- Apple macOS prior to Sequoia 15.8
- Apple macOS prior to Golden Gate 27
Discovery Timeline
- 2026-09-14 - CVE-2026-65374 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-65374
Vulnerability Analysis
The flaw resides in the macOS WebDAV client code path invoked when a user mounts or browses a remote WebDAV share. A malicious server can return crafted responses that the client fails to validate before writing data to memory. The result is an out-of-bounds write [CWE-787] that corrupts adjacent memory structures. An attacker who controls memory layout at the point of corruption can pivot to arbitrary code execution in the user's process context.
Root Cause
Apple's advisory attributes the fix to improved validation, indicating that the client accepted attacker-controlled sizes or offsets without sufficient bounds checking. Missing input validation on server-supplied WebDAV response fields allows a write beyond the intended buffer boundary. Out-of-bounds writes in network client code frequently enable control-flow hijacking through corruption of heap metadata, function pointers, or object vtables.
Attack Vector
Exploitation requires user interaction: the victim must connect to a WebDAV server operated by the attacker. Delivery vectors include phishing links using webdav:// or davs:// URI handlers, malicious documents referencing remote resources, and hijacked or spoofed shares on trusted networks. No authentication or elevated privileges are required on the target system. Code execution occurs with the privileges of the user initiating the WebDAV connection.
No public proof-of-concept exploit is currently listed for CVE-2026-65374. Refer to the Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for vendor technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-65374
Indicators of Compromise
- Outbound TCP connections to untrusted hosts on ports 80, 443, or 8080 originating from the webdavfs_agent process.
- Unexpected mounts under /Volumes/ created by mount_webdav referencing external or newly registered domains.
- Crash reports in ~/Library/Logs/DiagnosticReports/ referencing webdavfs_agent, WebDAVFS, or NetFS frameworks.
- Execution of child processes spawned from webdavfs_agent or Finder shortly after a WebDAV mount event.
Detection Strategies
- Alert on invocations of /sbin/mount_webdav and webdavfs_agent targeting non-corporate hosts.
- Correlate WebDAV mount events with subsequent process creation, shell activity, or persistence writes to LaunchAgents.
- Inspect Unified Logs for repeated WebDAV client crashes, which may indicate exploitation attempts against unpatched hosts.
Monitoring Recommendations
- Ingest macOS Endpoint Security Framework (ESF) telemetry covering process, file, and network events into a SIEM for correlation.
- Track DNS resolutions and TLS SNI values for webdav:// and davs:// destinations across the fleet.
- Baseline expected WebDAV endpoints and flag first-seen destinations for review.
How to Mitigate CVE-2026-65374
Immediate Actions Required
- Update macOS to Tahoe 26.7, Sequoia 15.8, or Golden Gate 27 on all affected endpoints.
- Inventory macOS assets and prioritize patching for users who routinely mount external file shares.
- Educate users to avoid clicking webdav:// or davs:// links from untrusted senders.
Patch Information
Apple released fixes across three macOS trains. See Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for release notes and update instructions. Apply the update relevant to the installed macOS train.
Workarounds
- Block outbound WebDAV traffic to untrusted destinations at the network perimeter until patches are deployed.
- Restrict use of the webdav:// and davs:// URI handlers via MDM configuration profiles where feasible.
- Disable auto-mounting of remote shares and require explicit user approval for new WebDAV endpoints.
# Verify installed macOS version to confirm patch level
sw_vers -productVersion
# Force a software update check and install available updates
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
