CVE-2026-84568

Apple patched a path traversal flaw (CWE-22) in macOS that is triggered when the system processes data returned by a network directory server, such as an LDAP/Active Directory server a Mac is bound to. An attacker who controls such a directory server can return directory data containing crafted traversal-style paths that escape their intended directories, causing macOS components running as root to write or execute files at attacker-chosen locations. Successful exploitation yields arbitrary code execution with root privileges on the client Mac. In principle all Macs running versions older than the fixed releases are vulnerable, but the realistic attack surface is limited to machines that consult a network directory server — primarily enterprise-managed Macs — because the attacker must first control that server, consistent with the CVSS 3.1 local attack vector and low-privilege prerequisites (7.8, high). The issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27; no public proof of concept or in-the-wild exploitation is known.

What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later), which contain the improved path validation. Until patched, audit and remove any unneeded network directory bindings (via Directory Utility or configuration profiles), restrict trusted directory servers to well-secured infrastructure, and watch directory-bound Macs for unexpected root-owned file writes or unfamiliar root processes. MDM operators should verify fleet-wide installation of the fixed builds and flag machines that cannot update.