CVE-2026-43698

Published: Jul 27, 2026Modified: Sep 14, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

Affected (3)

Products: Apple: Macos

Apple

1 product

Macos

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	14.0 ≤ version < 14.8.8
Apple Macos	15.0 ≤ version < 15.7.8
Apple Macos	26.0 ≤ version < 26.6

Related CWEs

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (4)

https://support.apple.com/en-us/128071

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/128072

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/149035

Source: product-security@apple.com

https://support.apple.com/en-us/149042

Source: product-security@apple.com

Timeline

No history available yet.