CVE-2026-86907: macOS System Keychain Privilege Escalation

CVE-2026-86907 Overview

CVE-2026-86907 is an authorization vulnerability in macOS that allows an application running with administrator privileges to modify the System Keychain. Apple addressed the issue by introducing improved entitlement checks in macOS Sequoia 15.8 and macOS Tahoe 26.7. The flaw is categorized under [CWE-862: Missing Authorization] and carries a local attack vector with high integrity impact. Successful exploitation requires existing admin-level access on the target system, limiting the attack surface to post-compromise scenarios or malicious installers granted elevated rights by the user.

Critical Impact
An admin-privileged application can tamper with the System Keychain, which stores system-wide credentials, certificates, and cryptographic keys used across the operating system.

Affected Products

Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7
Applications running with administrator privileges on vulnerable macOS builds

Discovery Timeline

2026-10-20 - CVE-2026-86907 published to the National Vulnerability Database
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-86907

Vulnerability Analysis

The vulnerability resides in the entitlement enforcement logic that gates write access to the macOS System Keychain. Admin group membership alone was treated as sufficient authorization for operations that should require a dedicated entitlement. An attacker-controlled process executing under an admin account can therefore invoke Keychain modification routines without carrying the entitlement normally required for such changes.

The System Keychain (/Library/Keychains/System.keychain) stores Wi-Fi passwords, enterprise certificates, VPN secrets, and machine-wide trust anchors. Modification of these records enables credential substitution, certificate trust manipulation, and persistence that survives user session changes. Because the issue is a missing authorization check rather than a memory corruption bug, exploitation is deterministic and does not depend on timing or memory layout.

Root Cause

The root cause is a missing authorization check [CWE-862]. The Keychain access control path validated only the caller's privilege level rather than verifying the specific entitlement required for System Keychain writes. Apple's fix replaces the privilege-based check with explicit entitlement validation.

Attack Vector

Exploitation requires local access and an application already running with administrator privileges. A malicious installer, a trojanized admin utility, or a compromised legitimate admin tool can leverage this flaw to alter keychain contents. User interaction is not required beyond the initial grant of admin rights. The vulnerability does not expose confidential data directly, but integrity loss on the System Keychain enables follow-on credential theft, man-in-the-middle positioning via rogue root certificates, and lateral movement.

See the Apple Support Article #149042 and Apple Support Article #149043 for vendor technical details.

Detection Methods for CVE-2026-86907

Indicators of Compromise

Unexpected writes or modifications to /Library/Keychains/System.keychain by processes lacking the Apple-signed Keychain entitlement.
New or altered trusted root certificates appearing in the System Keychain outside of MDM-driven deployments.
security command-line tool invocations (security add-certificate, security set-keychain-settings) spawned by non-administrative tooling or installer scripts.

Detection Strategies

Monitor Endpoint Security framework events for ES_EVENT_TYPE_NOTIFY_WRITE and ES_EVENT_TYPE_NOTIFY_RENAME targeting the System Keychain file path.
Alert on process executions of /usr/bin/security with keychain-modifying subcommands initiated by non-standard parent processes.
Baseline the inventory of trusted certificates and flag deltas introduced outside patch windows or MDM configuration pushes.

Monitoring Recommendations

Collect macOS Unified Log entries from the com.apple.securityd subsystem and forward them to a centralized analytics backend for correlation.
Track installations and launches of admin-privileged helper tools, particularly those installed via SMJobBless or legacy privileged helpers.
Audit MDM compliance reporting to confirm managed endpoints are running macOS Sequoia 15.8 or macOS Tahoe 26.7 or later.

How to Mitigate CVE-2026-86907

Immediate Actions Required

Deploy macOS Sequoia 15.8 or macOS Tahoe 26.7 to all affected endpoints through MDM or Software Update as the primary remediation.
Audit which users and service accounts hold administrator privileges and revoke rights that are not operationally required.
Review the System Keychain on potentially exposed hosts for unauthorized certificates or credential entries added before patching.

Patch Information

Apple shipped the fix in macOS Sequoia 15.8 and macOS Tahoe 26.7. The patch replaces privilege-based gating with entitlement checks on code paths that modify the System Keychain. Vendor advisories are published as Apple Support Article #149042 and Apple Support Article #149043.

Workarounds

Enforce the principle of least privilege by moving daily-use accounts to standard (non-admin) roles until patching completes.
Restrict installation of unsigned or non-notarized admin tooling via Gatekeeper policy and MDM configuration profiles.
Monitor and alert on modifications to /Library/Keychains/System.keychain as a compensating control pending patch rollout.

bash

# Verify installed macOS version against the patched builds
sw_vers -productVersion

# List current System Keychain contents for integrity review
sudo security dump-keychain /Library/Keychains/System.keychain | less

# Enumerate trusted root certificates for unauthorized additions
sudo security find-certificate -a -p /Library/Keychains/System.keychain