AppleCVE-2026-86933

Apple macOS: improper privilege management

CVE-2026-86933 · Published Oct 20, 2026 · updated Oct 29, 2026

Low3.3

Fix: upgrade to 27 or later

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.

Affected versions

Package	Affected	Fixed in
macOS Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-269

More Apple advisories

All Apple

High 7.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86977fixed in 27 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86940fixed in 27 Medium 5.5Oct 20

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86944fixed in 26.7 +2 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86948fixed in 27