CVE-2026-65375

An authentication weakness in macOS allows an app running on an affected Mac to cause unexpected system termination, effectively a local denial-of-service condition. The flaw is triggered when an app invokes a privileged system operation without the caller being properly authenticated, leading the system to crash or restart rather than rejecting the request. An attacker gains only an availability impact — repeated reboots or crashes of a victim's Mac — with no indication of code execution or data exposure. Affected users are those on macOS versions prior to the fixes, which shipped in macOS Sequoia 15.8, macOS Tahoe 26.6, and macOS Golden Gate 27 as part of a record-setting Apple patch batch. No public proof-of-concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation is presumed limited or absent.

What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.6, or macOS Golden Gate 27 as appropriate for your hardware, since the fix strengthens the authentication check that prevents apps from terminating the system. Restrict app installations to trusted, notarized sources such as the App Store, and enable Gatekeeper to reduce the chance of running a malicious app that could abuse this. Check logs for unexpected shutdowns or kernel panics that may indicate past abuse of this behavior.