CVE-2026-65382: Apple macOS Path Traversal Vulnerability

CVE-2026-65382 Overview

CVE-2026-65382 is a path traversal vulnerability [CWE-22] in Apple macOS. The flaw stems from improper parsing of directory paths, allowing a local application to bypass access controls and read sensitive user data. Apple addressed the issue with improved path validation in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

Exploitation requires local access and low privileges, with no user interaction needed. The vulnerability affects confidentiality but does not impact integrity or availability. Attackers who install or run a malicious application on a target Mac can leverage this flaw to reach files that macOS privacy controls should otherwise protect.

Critical Impact
A malicious application can read sensitive user data by exploiting inconsistent directory path parsing on affected macOS versions.

Affected Products

Apple macOS versions prior to Tahoe 26.7
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Golden Gate 27

Discovery Timeline

2026-09-14 - CVE-2026-65382 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-65382

Vulnerability Analysis

CVE-2026-65382 is a path traversal weakness [CWE-22] in macOS directory path handling. The affected component fails to consistently canonicalize or validate paths before granting file system access. An application running with standard user privileges can craft paths that resolve to locations outside the caller's authorized scope.

The result is unauthorized read access to sensitive user data. Because the flaw sits in path parsing rather than in a specific privileged service, it undermines the file system boundaries macOS enforces around Transparency, Consent, and Control (TCC) protected directories and other user data stores.

Root Cause

The root cause is inadequate path validation. When a caller supplies a directory path, the vulnerable logic normalizes the input in a way that diverges from how downstream access control checks interpret the same string. This parser disagreement allows crafted paths to pass validation while still resolving to protected locations at access time.

Apple's fix applies stricter path validation to close the gap between parsed and enforced paths.

Attack Vector

The attack vector is local. An attacker must deliver and execute code on the target Mac, typically through a signed or unsigned application the user runs. No additional user interaction is required beyond running the malicious app, and no elevated privileges are needed.

Once running, the app issues file system requests using crafted directory paths that exploit the parsing inconsistency. Successful exploitation returns sensitive user data such as documents, application data, or other files that macOS privacy protections should have blocked. See the Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor details.

Detection Methods for CVE-2026-65382

Indicators of Compromise

Unsigned or newly installed applications issuing file system requests containing traversal sequences such as ../ or symbolic link references to protected user directories.
Unified log entries showing sandboxed processes accessing paths outside their container without a corresponding TCC prompt.
Unexpected reads of files under ~/Library, ~/Documents, or other user data locations by non-Apple binaries.

Detection Strategies

Monitor Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_OPEN, ES_EVENT_TYPE_NOTIFY_READDIR) for processes accessing sensitive paths outside expected scope.
Baseline application file access patterns and alert on deviations, especially reads targeting user home subdirectories from non-productivity applications.
Correlate application install events with subsequent access to TCC-protected directories to surface newly deployed tools probing for data.

Monitoring Recommendations

Ingest macOS unified logs and Endpoint Security telemetry into a centralized analytics platform for retention and hunting.
Track macOS build versions across the fleet to identify hosts still running vulnerable releases prior to 15.8, 26.7, or Golden Gate 27.
Alert on execution of unsigned binaries or binaries with untrusted developer IDs that perform broad directory enumeration shortly after launch.

How to Mitigate CVE-2026-65382

Immediate Actions Required

Update all affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 as soon as feasible.
Inventory endpoints by OS build to identify systems still exposed to CVE-2026-65382.
Restrict installation of untrusted applications through Gatekeeper policy and mobile device management (MDM) controls.

Patch Information

Apple resolved the vulnerability with improved path validation. Patched releases are documented in Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Deploy the update through Software Update or an MDM patch management workflow.

Workarounds

No vendor workaround is published; patching is the supported remediation path.
Limit local user privileges and prevent execution of unapproved applications until patches are deployed.
Enforce application allowlisting and review TCC permission grants to minimize the data exposed to a malicious local process.

bash

# Verify current macOS version on managed endpoints
sw_vers -productVersion

# Trigger software update check via MDM or locally
sudo softwareupdate --list
sudo softwareupdate --install --all --restart