CVE-2026-86907

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/149042	Vendor Advisory Release Notes
https://support.apple.com/en-us/149043	Vendor Advisory Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

History

03 Nov 2026, 21:01

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:macos::::::::
References	~~() https://support.apple.com/en-us/149042 -~~	() https://support.apple.com/en-us/149042 - Vendor Advisory, Release Notes
References	~~() https://support.apple.com/en-us/149043 -~~	() https://support.apple.com/en-us/149043 - Vendor Advisory, Release Notes
First Time		Apple Apple macos

20 Oct 2026, 15:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.4
CWE		CWE-862

20 Oct 2026, 01:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 01:17

Updated : 2026-11-03 21:01

NVD link : CVE-2026-86907

Mitre link : CVE-2026-86907

CVE.ORG link : CVE-2026-86907

JSON object : View

Products Affected

apple

macos

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-86907", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86907", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T14:52:34.585332Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "15.8", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.7", "versionType": "custom"}]}]}], "published": "2026-10-20T01:17:26.530", "references": [{"url": "https://support.apple.com/en-us/149042", "tags": ["Vendor Advisory", "Release Notes"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149043", "tags": ["Vendor Advisory", "Release Notes"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain."}], "lastModified": "2026-11-03T21:01:24.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "027D0062-9C57-4DF6-BE4D-70FD88DB40E4", "versionEndExcluding": "15.8"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BE83000-26C0-49C5-A966-BB40AD6F8BEE", "versionEndExcluding": "26.7", "versionStartIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}