CVE-2026-43691

Executive Summary

CVE-2026-43691 is a local privilege escalation vulnerability in Apple macOS caused by a path handling flaw (CWE-22, path traversal) that was addressed through improved validation. The vulnerability allows a locally executing application to gain root privileges on an affected system. Any macOS host running a version prior to the listed fixed releases (Golden Gate 27, Sequoia 15.8, Tahoe 26.7) is potentially affected, and successful exploitation yields full system compromise at the highest privilege level.

Technical Analysis

Apple's advisory-style description states that the issue is a "path handling issue" addressed "with improved validation," classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., path traversal). The impact is stated plainly: "An app may be able to gain root privileges." This maps the flaw to a local privilege escalation (LPE) primitive rather than a remote code execution vector.

The attack surface is a locally installed or executed application. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the preconditions: the attacker requires local access and low privileges, needs no user interaction, and the attack is trivially automatable (AC:L). Because the vector uses scope-unchanged (S:U), the vulnerable component and the impacted component are the same security authority context — here, the path-handling logic that governs access to privileged resources.

At the vulnerability-class level, a path handling defect means the affected component fails to correctly canonicalize, validate, or constrain a caller-supplied path. When a privileged context subsequently acts on that path, the validation gap can permit the operation to resolve to an unintended location or resource that should be restricted to root. The description does not disclose which specific macOS subsystem, binary, or interface is affected, nor does it name any function, path, or parameter. No further code-level detail is derivable from the provided data, and none should be assumed. The defining characteristic is: insufficient validation of a path leads to a privileged operation being performed on attacker-influenced input, escalating the calling app to root.

The EPSS score is 0.00166 (6.2% percentile), indicating a low predicted probability of exploitation in the near term. There is no public PoC, no exploit code, and no Nuclei template available. CISA KEV does not list this CVE, and there is no evidence of in-the-wild exploitation.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-43691; the attack chain below is inferred strictly from the vulnerability class (CWE-22) and the stated impact (local privilege escalation to root). Specific implementation details are intentionally omitted because they are not present in the source data.

1. Reconnaissance / target identification. The attacker obtains a foothold as a low-privileged local user on a macOS host — via a delivered malicious application, a compromised user session, or any code-execution primitive running as a standard user. They fingerprint the OS build to confirm it predates macOS Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.

2. Triggering the path handling flaw. The malicious application supplies a crafted path as input to the affected, privileged path-handling logic. Because the component fails to validate or canonicalize the path correctly, the supplied value is not constrained as intended.

3. Privileged execution at the vulnerability-class level. The privileged component processes the attacker-influenced path, and the resulting operation — intended to be restricted — is performed in a root context. This is the classic path traversal / improper pathname limitation pattern: attacker-controlled input reaches a privileged file or resource operation. No specific file paths or API calls are named because the advisory does not disclose them.

4. Post-exploitation impact. The calling application gains root privileges, providing full control over the local system: arbitrary code execution as root, access to protected data, and the ability to persist, alter system configuration, or disable security controls. The scope-unchanged CVSS rating means impact is confined to the local security authority (the macOS host's privilege model), though root on a host is typically a stepping stone to broader environment compromise.

Impact Assessment

A CVSS base score of 7.8 (High) reflects the severity balance of this issue. The attack requires only local access and low privileges (AV:L, PR:L) and no user interaction (UI:N), making it reliably automatable. Confidentiality, Integrity, and Availability are each rated High (C:H/I:H/A:H) because root-level access on a macOS endpoint exposes all local data, permits arbitrary modification, and allows denial or destruction of system components. The low attack complexity (AC:L) and unchanged scope (S:U) mean a single exploitable component is sufficient to elevate an unprivileged app to root within the same security boundary.

Business impact is significant for any organization with macOS fleets: an attacker who already has a foothold (phishing payload, insider, compromised user account, or supply-chain-delivered app) can escalate to full administrative control of the endpoint. This enables credential theft, lateral movement, tampering with endpoint detection tooling, and persistence that survives user-level cleanup. Blast radius is host-scoped per instance but scales with fleet size; a single macOS host is a high-value target for further intrusion. The absence of KEV listing, public exploits, and nontrivial EPSS signal indicates that mass exploitation is not currently observed, so prioritization is driven by endpoint exposure and the presence of untrusted local code execution paths rather than active threat campaigns.

Detection Guidance

Sigma Rule

title: Suspicious macOS Privilege Escalation via Path Handling (CVE-2026-43691)
id: 8f4b1c2a-3d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects processes originating from non-root users spawning privileged children or writing to restricted system paths, consistent with local privilege escalation via path traversal on macOS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-43691
author: valtersit.com
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: macos
  category: process_creation
detection:
  selection_user:
    User|endswith:
      - '/Users/'
  selection_privileged_child:
    ParentImage|endswith:
      - '/Applications/'
    Image|startswith:
      - '/usr/sbin/'
      - '/usr/bin/'
      - '/System/'
  filter_known:
    Image|endswith:
      - '/softwareupdate'
      - '/installer'
  condition: selection_user and selection_privileged_child and not filter_known
falsepositives:
  - Legitimate installers and management agents
level: medium

YARA Rule

rule CVE_2026_43691_macOS_priv_esc_path_handling
{
    meta:
        description = "Heuristic detection for macOS binaries abusing path handling for privilege escalation (CVE-2026-43691)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-43691"
        severity = "high"

    strings:
        $macho = { CF FA ED FE }
        $macho64 = { CF FA ED FE 07 00 00 01 }
        $t1 = "../" ascii
        $t2 = "..%2f" ascii nocase
        $t3 = "%2e%2e" ascii nocase
        $setuid = "setuid(" ascii
        $seteuid = "seteuid(" ascii
        $privhelper = "setuid(0)" ascii

    condition:
        ($macho or $macho64) and 1 of ($t*) and 1 of ($setuid, $seteuid, $privhelper)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-43691 macOS path traversal encoding observed in outbound app traffic"; flow:to_server,established; content:"..%2f"; http_uri; nocase; sid:202643691; rev:1; classtype:attempted-user; reference:cve,2026-43691; metadata:created_at 2026_01_01, vendor Apple, product macOS;)

Elastic Detection

process where event.type == "start" and
  process.parent.executable : ("/Applications/*" or "/Users/*") and
  process.executable : ("/usr/sbin/*", "/usr/bin/*", "/System/*") and
  process.user.name != "root" and
  process.parent.user.name != "root"

Splunk SPL Query

index=macos_security sourcetype=osquery:process_events OR sourcetype=macos_unified_log
(process_path="/usr/sbin/*" OR process_path="/usr/bin/*" OR process_path="/System/*")
(parent_process_path="/Applications/*" OR parent_process_path="/Users/*")
NOT user="root"
| stats count values(process_path) as child_procs values(parent_process_path) as parents by host user
| where count > 0

Wazuh OSSEC Rule

<group name="macos,cve-2026-43691,">
  <rule id="100691" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">process_creation</field>
    <field name="parent_image">/Applications/</field>
    <field name="image">/usr/sbin/</field>
    <field name="user">!(root)</field>
    <description>CVE-2026-43691: possible macOS local privilege escalation - non-root app spawning privileged process</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The fix is asserted by the NVD entry only and has not been independently corroborated by a vendor advisory reviewed here.

1. Immediate mitigations (while patch verification and rollout are pending):

   • Restrict the ability of unprivileged users to launch untrusted applications; enforce application control/allowlisting (e.g., macOS Gatekeeper plus a managed endpoint policy) so unvetted apps cannot execute.
   • Apply the principle of least privilege to endpoint user accounts; avoid granting admin rights to standard users.
   • Monitor for and investigate anomalous process trees where a user-context application spawns root-level or system-path children, using the detection content above.

2. Patch / upgrade steps:

   • Update macOS to the fixed release for the applicable branch: macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7.
   • Verify the installed build after updating and confirm the version meets or exceeds the fixed release.
   • Because patch confidence is only CLAIMED, confirm the update via Apple's own security advisory channel before considering the host remediated.

3. Long-term hardening:

   • Maintain a rapid macOS patch cadence and inventory OS builds across the fleet to identify hosts below the fixed versions.
   • Minimize local code-execution opportunities through application allowlisting, reduced local admin rights, and prompt removal of unused software.
   • Continuously monitor for privilege-escalation behavior (T1068) and validate that endpoint detection tooling covers process-tree and file-path anomalies at the system level.

References

• NVD — CVE-2026-43691: https://nvd.nist.gov/vuln/detail/CVE-2026-43691
• MITRE CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1068 (Exploitation for Privilege Escalation): https://attack.mitre.org/techniques/T1068/
• Apple Security Releases (vendor advisory index — verify the corresponding security update for the fixed versions): https://support.apple.com/en-us/HT201222
• FIRST EPSS (score 0.00166): https://www.first.org/epss/

Threat actor / exploit-in-the-wild note: CISA KEV does not list this CVE, no public proof-of-concept, exploit code, or Nuclei template exists, and EPSS is low (0.00166, 6.2% percentile). No named threat actor campaign or in-the-wild exploitation evidence is associated with CVE-2026-43691 in the provided data.