CVE-2026-65375 Overview
CVE-2026-65375 is an authentication weakness [CWE-287] in Apple macOS that allows a local application to trigger unexpected system termination. Apple addressed the issue with improved authentication in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.6. The flaw affects the availability of the operating system and can result in a denial-of-service condition on impacted hosts.
Critical Impact
An application running on a vulnerable macOS host can cause the system to terminate unexpectedly, disrupting user workloads and any services running on the affected endpoint.
Affected Products
- Apple macOS versions prior to Golden Gate 27
- Apple macOS Sequoia versions prior to 15.8
- Apple macOS Tahoe versions prior to 26.6
Discovery Timeline
- 2026-09-14 - CVE-2026-65375 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-65375
Vulnerability Analysis
The vulnerability is classified as an Improper Authentication issue [CWE-287] within a component of Apple macOS. According to Apple, the underlying flaw allowed an application to reach code paths that should have required stronger authentication checks. Exploitation results in unexpected system termination rather than code execution or data disclosure.
The issue is limited to availability impact. Apple resolved the weakness by strengthening authentication controls in the affected component across the Golden Gate, Sequoia, and Tahoe release trains.
Root Cause
Apple's advisory states that the issue was addressed with improved authentication. The pre-patch implementation did not sufficiently verify the caller before performing an operation that could destabilize the operating system. When invoked without adequate validation, the operation drives the system into a fault state that forces termination.
Attack Vector
The attack requires an application to run on the target macOS host and interact with the vulnerable component. Successful exploitation causes the host to terminate, interrupting user sessions and any workloads on that endpoint. Apple's advisory does not describe a remote path to trigger the flaw without a local application.
No public proof-of-concept exploit is available at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed evidence of exploitation in the wild.
Refer to Apple's advisories for component-specific details: Apple Support Article on Security, Apple Security Update Information, and Apple Security Advisory Overview.
Detection Methods for CVE-2026-65375
Indicators of Compromise
- Unexpected kernel panics or sudden system reboots on macOS endpoints running unpatched builds prior to Sequoia 15.8, Tahoe 26.6, or Golden Gate 27.
- Panic logs in /Library/Logs/DiagnosticReports/ referencing the affected component around the time of application activity.
- Repeated availability incidents on the same host that correlate with the launch of a specific third-party or unsigned application.
Detection Strategies
- Inventory macOS build versions across the fleet and flag hosts running versions earlier than 15.8, 26.6, or Golden Gate 27.
- Correlate crash reports and reboot events with process execution telemetry to identify applications that consistently precede system termination.
- Baseline expected reboot frequency per endpoint and alert on statistically significant increases.
Monitoring Recommendations
- Forward macOS unified logs and diagnostic reports to a centralized log platform for retention and correlation.
- Monitor for newly installed or unsigned applications that gain execution on managed macOS endpoints.
- Track patch compliance for macOS updates released in September 2026 and generate alerts for hosts that remain on vulnerable builds.
How to Mitigate CVE-2026-65375
Immediate Actions Required
- Update all macOS endpoints to macOS Sequoia 15.8, macOS Tahoe 26.6, or macOS Golden Gate 27 as applicable to the hardware.
- Prioritize systems that run untrusted or third-party applications, since exploitation requires an app to reach the vulnerable code path.
- Validate patch deployment through mobile device management (MDM) reporting and endpoint telemetry.
Patch Information
Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.6. Details are available in the Apple Support Article on Security, Apple Security Update Information, and Apple Security Advisory Overview.
Workarounds
- Restrict installation and execution of untrusted applications on macOS endpoints using Gatekeeper, notarization enforcement, and MDM application allowlists.
- Apply the principle of least privilege for user accounts to reduce the set of applications that can be launched on production hosts.
- Enforce automatic macOS updates via MDM configuration profiles until all endpoints are on a fixed release.
# Verify the installed macOS version on an endpoint
sw_vers -productVersion
# Check for available Apple software updates
sudo softwareupdate --list
# Install all available updates and restart when required
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
