radar

macOS root flaw, the exploit code is public

A macOS flaw fixed on September 14 hands root to a plain app, and its exploit code is public. The versions to aim for, and how to check yours.

On September 14, Apple plugged a macOS flaw that lets a plain app become root, the absolute master of your Mac. On September 21, the code to exploit it showed up in open access on GitHub. If your Mac hasn’t moved since the summer, now is when it counts.

What happened

The flaw is tracked as CVE-2026-43786. It sits in CoreServices, a foundation of macOS services that almost every app relies on. Apple sums it up in one line, an app may be able to gain root privileges.

The fix adds checks on the entitlements an app claims from the system. The flaw was reported by Kujtim Kryeziu, a researcher at Sentry. It has been fixed since September 14 in macOS Sequoia 15.8, Tahoe 26.7 and Golden Gate 27.

A week later, on September 21, Malwation published a proof of concept on GitHub, a code file and a demo video. Apple knows about it and has fixed it, but the recipe is now out there. Macs that haven’t installed the update are exactly the target.

Root, in practice

On your Mac, your account, even an administrator one, asks for your password again before touching the system. Root is the account above that, the one that asks nobody for anything, the one with every right.

The scenario plays out in three steps. A booby-trapped app lands on your Mac, a free utility, a fake update, an attachment. It runs with your ordinary rights, without being an administrator, without you having to click on anything more. It exploits the flaw, and it becomes root.

The US cybersecurity agency, CISA, rated the flaw 7.8 out of 10, high severity. That score doesn’t come from Apple, which never publishes one. Why not 9 or 10? Because the attacker first has to get an app running on your Mac.

Exploited? Not to date

Some headlines already call it an “exploited” flaw. Nothing confirms it. Apple doesn’t say so, and the flaw isn’t on the list of exploited flaws kept by CISA.

What is true is that the attack code is public. For anyone who’d want to use it, half the work is done.

A wave of fixes, not an isolated flaw

This flaw lands in the middle of a busy series.

August 6. Apple fixes a Screen Sharing flaw that let an attacker on the network connect to it without valid credentials. CISA rated it 9.8 out of 10, and added it on August 18 to its list of exploited flaws.

September 14. Sequoia 15.8, Tahoe 26.7 and Golden Gate 27, with the CoreServices flaw.

September 28. Sequoia 15.8.1 and Tahoe 26.7.1 fix a flaw in CoreGraphics, the engine that draws images and documents. A booby-trapped file can get code executed through it. Apple says it may have been exploited on iPhone, on a version of iOS before iOS 27, in an extremely sophisticated attack against targeted individuals.

The same code runs on the Mac, hence the fix. CISA added it to its list on September 29. Golden Gate 27.0.1 came out the same day, and Apple lists no fixed flaw for it.

So don’t aim for 15.8 or 26.7, aim for the latest version. On Sequoia and Tahoe, it covers all three in one go.

What you need to do

Check your version. Apple menu > About This Mac. The number shows up under the name of the system.

The versions to reach. Sequoia 15.8.1 or Tahoe 26.7.1, or later. On Golden Gate, the latest version available, 27.0.1 to date. Golden Gate is reserved for Apple silicon Macs. An Intel Mac stays on Tahoe or Sequoia, and must be on 26.7.1 or 15.8.1.

Update. System Settings > General > Software Update. In the same screen, click the (i) next to “Automatic Updates” and turn on “Install macOS updates”. Upcoming versions, like 15.8.1 or 26.7.1, will then install without waiting for your click.

Also turn on “Install system data files and security updates” on Tahoe and Golden Gate, “Install Security Responses and system files” on Sequoia. On Tahoe and Golden Gate, rapid security fixes have their own setting, in Privacy & Security > Background Security Improvements, option “Automatically Install”.

Still on Sonoma or older? Sonoma got no update on September 14, and Apple doesn’t say whether this version is affected by the flaw. No reason to panic, no reason to sleep soundly either. If your Mac can move to a maintained version, do it.

Some of the fixes, Apple already pushes quietly, without asking your opinion. Version updates, on the other hand, wait for your click as long as that setting stays off.

Read also, Your Mac was patched by XProtect without your knowledge, it’s for your own good

In the meantime

The flaw needs a malicious app already installed. That’s where you keep control. Install your apps from the App Store or their developer’s website, leave Gatekeeper on, and be wary of any “update” offered to you by email or from a web page.

An antivirus alone doesn’t close this door. What to stack on top of it, we’ve laid out in detail.

Read also, Antivirus alone no longer protects your Mac

The attack code is online, and so is the fix. The only question is which of the two reaches your Mac first.

MacSouverain