AppleCVE-2026-86928

Apple macOS: path traversal

CVE-2026-86928 · Published Oct 20, 2026 · updated Oct 29, 2026

Medium5.5

Fix: upgrade to 27 or later

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data.

Affected versions

Package	Affected	Fixed in
macOS Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-22

More Apple advisories

All Apple

High 7.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86977fixed in 27 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86940fixed in 27 Medium 5.5Oct 20

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86944fixed in 26.7 +2 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86948fixed in 27