CVE-2026-43691

CVE-2026-43691 is a path handling vulnerability in macOS in which insufficient validation of file paths allows a locally running app to elevate its privileges to root. Exploitation requires an attacker to first get a malicious or compromised app onto a victim's Mac, after which the app can abuse the flawed path handling to gain full system privileges. The issue was addressed with improved validation and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, meaning Macs running earlier builds of these releases remain exposed. As a local privilege escalation, it is primarily a post-compromise primitive that malware or a limited user could use to take over the machine, rather than a remote entry vector. There is no public proof of concept, the CVE is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Patch to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) and push the updates via MDM as soon as they clear testing. Because exploitation requires a malicious app already on the endpoint, enforce Gatekeeper/notarization policies and block unsigned or untrusted software to shrink the attack surface. Monitor EDR telemetry for existing processes attempting unexpected privilege escalation to root.