CVE-2026-84568: Apple macOS Path Traversal Vulnerability

CVE-2026-84568 Overview

CVE-2026-84568 is a path traversal vulnerability [CWE-22] affecting multiple versions of Apple macOS. The flaw resides in code that processes paths supplied by a network directory server. An attacker who controls that directory server can leverage insufficient path validation to execute arbitrary code with root privileges on connected macOS clients. Apple addressed the issue through improved path validation in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

Critical Impact
A malicious network directory server can achieve arbitrary code execution as root on macOS clients bound to it, resulting in full system compromise.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia prior to 15.8
Apple macOS Tahoe prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84568 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-84568

Vulnerability Analysis

The vulnerability stems from improper validation of file system paths returned by a network directory server. macOS clients can bind to directory services such as LDAP or Open Directory to retrieve user, group, and configuration data. When the client processes attributes that reference file system paths, insufficient sanitization allows traversal sequences to escape intended directories.

Because directory service lookups on macOS run within privileged system daemons, an attacker who controls the responses can direct the client to load or execute resources from arbitrary filesystem locations. Successful exploitation results in code execution in the context of the root user.

Root Cause

The root cause is missing or incomplete canonicalization of path components supplied by the network directory server. Apple's advisory describes the remediation as "improved path validation," indicating that the vulnerable code accepted relative or traversal-laden paths (../) without normalizing and constraining them to an expected base directory.

Attack Vector

Exploitation requires an attacker to control a network directory server that the target macOS host consults, or to hijack directory server traffic. Once positioned, the attacker returns crafted attribute values containing traversal sequences that reference attacker-controlled or sensitive files. Attack complexity is low and no user interaction is required, but the client must already be configured to trust the directory server.

No verified proof-of-concept has been published. Refer to Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for vendor technical detail.

Detection Methods for CVE-2026-84568

Indicators of Compromise

Unexpected root-owned processes spawned by directory service daemons such as opendirectoryd or DirectoryService.
New or modified files in system directories written shortly after directory server queries.
Directory server responses containing path attributes with ../ sequences or absolute paths pointing outside expected locations.

Detection Strategies

Inspect network traffic to bound directory servers for anomalous attribute values, particularly path fields containing traversal characters.
Baseline the child processes of opendirectoryd and alert on deviations, such as shells or interpreters launched as root.
Correlate directory service activity with subsequent filesystem writes to privileged paths (/Library, /System, /usr).

Monitoring Recommendations

Enable and forward Apple Endpoint Security telemetry covering process execution and file modification events to a centralized analytics platform.
Monitor macOS Unified Logs for opendirectoryd errors, path parsing warnings, and unexpected privilege transitions.
Track the macOS build versions across the fleet and alert on hosts that remain below the patched releases.

How to Mitigate CVE-2026-84568

Immediate Actions Required

Update all macOS endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as appropriate for the hardware.
Audit which macOS systems are bound to network directory servers and validate that each configured server is trusted and hardened.
Restrict directory service traffic to authenticated, encrypted channels and known server addresses.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Deployment guidance and the full advisory text are available in Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043.

Workarounds

Unbind macOS clients from untrusted or unnecessary network directory servers until patches are applied.
Enforce LDAP over TLS with strict certificate validation to prevent directory server impersonation.
Segment directory service infrastructure so that only administrative networks can reach it, reducing the risk of a rogue server on the client subnet.

bash

# Verify installed macOS version against patched releases
sw_vers -productVersion

# List currently bound directory service nodes
dscl localhost -list /Search

# Remove an untrusted LDAP node from the search policy (example)
sudo dsconfigldap -r ldap.example.com