CVE-2026-65345

Executive Summary

CVE-2026-65345 is an improper access control vulnerability (CWE-284) in Apple operating systems across iOS, iPadOS, and macOS product lines. The flaw allows a local application to access user-sensitive data by circumventing intended permission restrictions; Apple addressed it by adding "additional restrictions" in the affected permission-handling code paths. An attacker who convinces a user to install or open a malicious app can read sensitive user data without triggering the intended authorization model. No public proof-of-concept, exploit code, or CISA KEV listing currently exists, and EPSS is low (0.00170, ~6.7th percentile).

The rating (CVSS 5.5, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a local attack requiring user interaction, with high confidentiality impact but no integrity or availability impact. Exploitation is constrained by the local vector and UI requirement, which limits mass remote exploitation but makes it attractive for social-engineering-facilitated malicious apps, sideloaded software, or supply-chain-inserted components. Organizations managing fleets of Apple endpoints should prioritize patching because the vulnerability class (permission bypass) is routinely weaponized in commodity macOS/iOS malware, even without a specific public exploit for this CVE.

Technical Analysis

CWE-284 (Improper Access Control) covers a broad class of flaws where an application, process, or component fails to enforce the authorization policy it claims to enforce. The NVD description for CVE-2026-65345 states plainly: "A permissions issue was addressed with additional restrictions." This language is characteristic of Apple security advisories for sandbox, TCC (Transparency, Consent, and Control), entitlement, or XPC/permission-check defects where an application can bypass a consent boundary and reach data the user has not authorized it to access.

Key attributes derivable strictly from the provided data:

• Attack vector (AV:L — Local): The flaw is not remotely reachable over a network. The adversary must be present on the device, typically through a malicious or compromised application already executing in the user's context.
• Privileges required (PR:N — None): No elevated privileges or special entitlements are needed. A normal app running with standard user privileges can trigger the issue.
• User interaction (UI:R — Required): The victim must take an action — for example, installing, launching, or granting some baseline interaction with the malicious app.
• Scope (S:U — Unchanged): The security authority is not crossed; the impact stays within the component's own security context.
• Confidentiality (C:H): High. The vulnerability explicitly permits access to "user-sensitive data."
• Integrity (I:N) / Availability (A:N): No modification or denial-of-service impact is described.

The "permissions issue … addressed with additional restrictions" phrasing indicates Apple tightened an authorization check rather than fixing memory-corruption or injection logic. That means the underlying mechanism is a logic-level authorization gap: a code path that resolved a permission decision incorrectly (for example, returning success when a check should have failed, or omitting a check on an alternate code path). Because Apple does not publish the internal check's identifier, no specific API, function, entitlement name, or file path can be responsibly named here — the report intentionally avoids inventing them.

Affected platforms span the current Apple ecosystem: iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. That broad matrix implies the shared permission framework is common across Apple's platforms, and the fix was rolled forward into multiple maintained branches simultaneously — a strong indicator that this is a core system-framework authorization defect rather than an app-specific bug.

Patch confidence is 2/4 (CLAIMED). A single source (NVD) asserts the fix; the vendor advisory was not independently retrieved during this analysis, and no CVE-specific workaround or vendor-fix detail beyond version numbers is available.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-65345. The following chain is inferred at the vulnerability-class level from the NVD description and CVSS metrics; it does not rely on invented function, API, or file names.

1. Reconnaissance / target identification. Because the vector is local (AV:L), the adversary must first establish code execution on the target device. Realistic delivery paths include a sideloaded or enterprise-signed application, a malicious app distributed through a third-party or official app marketplace, a trojanized update, or a compromised legitimate app. The attacker profiles the target's OS build to confirm it falls below iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7.

2. Triggering the specific flaw class. Once the app executes, it attempts to reach data the operating system's permission framework is supposed to protect. The vulnerability is a permission-enforcement gap (CWE-284): the app requests or indirectly accesses a resource that should require explicit user consent, and the flawed check permits the access. Per the advisory's "additional restrictions" wording, the defect is in the authorization decision itself, not in a memory-safety primitive. No specific API call, entitlement, or inter-process interface is named in the source data, so the exact trigger cannot be responsibly enumerated.

3. Payload / execution at the class level. The user-interaction requirement (UI:R) means the attack succeeds only after the victim installs or opens the malicious app. There is no remote, unauthenticated trigger. The "payload" is simply the app's normal code reaching the under-protected data path — no memory-corruption exploit primitive is implied by the description.

4. Post-exploitation impact. Successful exploitation yields high confidentiality impact (C:H): the app obtains user-sensitive data it should not be able to read. No integrity or availability impact is described, so the flaw is a data-disclosure/permission-bypass issue rather than a persistence or destructive primitive. Extracted data could feed follow-on social engineering, credential theft, or surveillance, consistent with commodity Apple-platform malware that abuses consent-bypass bugs.

Overall exploitation likelihood is constrained: EPSS is 0.00170 (~6.7th percentile), no KEV listing, and no public exploit. The practical risk today is driven by the vulnerability class rather than an active campaign.

Impact Assessment

Business impact is centered on confidentiality loss from untrusted or trojanized apps on managed Apple endpoints. CVSS subscores frame the risk precisely:

• AV:L / PR:N / UI:R — The attack needs local code execution plus a user action, so remote mass-exploitation is not enabled. This lowers urgency relative to a network-wormable flaw.
• C:H — The confidentiality impact is high; "user-sensitive data" is broad and could include personal or business data the permission framework is designed to gate.
• I:N / A:N — No data modification or service disruption.
• S:U / Base 5.5 (Medium) — Impact remains within the component's security authority; the baseline is a medium-severity disclosure.

Blast radius spans all unpatched Apple devices in scope: iPhones and iPads on iOS/iPadOS below 26.7 (and below 27 for the newer branch), plus Macs on macOS Golden Gate below 27, macOS Sequoia below 15.8, and macOS Tahoe below 26.7. For enterprises, BYOD and mixed-fleet environments carry the largest exposure because an unmanaged or sideloaded app is the likely delivery vehicle for a permission-bypass attack. Devices that cannot be immediately patched remain exposed for the full disclosure window. Because no exploit is public, actuarial risk today is low, but the medium base score and high confidentiality impact warrant inclusion in routine patch cycles.

Detection Guidance

Detection for a permission-bypass class bug is challenging because there is no public PoC, no known malicious file signature, and no specific API to instrument. The rules below target the class of behavior (untrusted apps reaching protected resources, suspicious app install/launch chains) and are written defensively; they are not CVE-specific signatures and should be tuned to the environment.

Sigma Rule

title: Suspicious Local Process Accessing Protected User Data (Permission Bypass Class)
id: 7c9f2a41-3b6e-4d1a-9f0e-2026653450aa
status: experimental
description: Detects processes launched from user-writable or untrusted locations attempting broad access to protected user data, consistent with CWE-284 permission-bypass abuse on Apple platforms via EDR telemetry.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65345
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: macos
detection:
  selection_path:
    Image|startswith:
      - '/Users/Shared/'
      - '/tmp/'
      - '/private/tmp/'
      - '/Users/'
  selection_access:
    CommandLine|contains:
      - 'Library/Application Support'
      - 'Library/Containers'
      - 'Library/Group Containers'
  condition: selection_path and selection_access
falsepositives:
  - Legitimate user-installed applications accessing their own sandbox containers
level: medium
tags:
  - attack.t1068
  - cve.2026.65345

YARA Rule

rule CVE_2026_65345_Permission_Bypass_Generic
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Generic heuristic for macOS/iOS binaries that attempt broad access to protected user data paths consistent with CWE-284 permission bypass; not CVE-specific"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65345"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "Library/Application Support" ascii
        $p2 = "Library/Containers" ascii
        $p3 = "Library/Group Containers" ascii
        $p4 = "Library/Preferences" ascii
        $tcc = "kTCCService" ascii

    condition:
        (uint32(0) == 0xfeedface or uint32(0) == 0xfeedfacf or uint32(0) == 0xcafebabe) and
        2 of ($p*) or $tcc
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65345 Possible Apple App Data Exfiltration Beacon (Permission Bypass Post-Exploitation)"; flow:established,to_server; http.method; content:"POST"; http.header; content:"User-Agent"; content:"CFNetwork"; http.uri; content:"/collect"; threshold: type both, track by_src, count 5, seconds 60; classtype:policy-violation; sid:2026653450; rev:1; reference:cve,2026-65345;)

Note: because the vulnerability is purely local (AV:L) with no network component, this rule only covers post-exploitation data-exfiltration chatter from a compromised app; there is no network signature for the permission-bypass trigger itself.

Elastic Detection

process where event.type == "start" and
  process.executable : ("/Users/Shared/*", "/tmp/*", "/private/tmp/*") and
  process.command_line : ("*Library/Application Support*", "*Library/Containers*", "*Library/Group Containers*")

This EQL hunt surfaces unsandboxed or user-launched processes reading protected user-data directories, the behavioral footprint expected when a permission-bypass (CWE-284) flaw is abused on an Apple endpoint.

Splunk SPL Query

index=endpoint sourcetype=macos_unified_log OR sourcetype=osquery
(EventType=exec OR action=process_start)
| search (process_path="/Users/Shared/*" OR process_path="/tmp/*" OR process_path="/private/tmp/*")
| search (cmdline="*Library/Application Support*" OR cmdline="*Library/Containers*" OR cmdline="*Library/Group Containers*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, process_path, cmdline
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="apple,macos,permission_bypass,">
  <rule id="202665" level="8">
    <decoded_as>json</decoded_as>
    <field name="process_path">\.(Users/Shared|tmp|private/tmp)</field>
    <field name="cmdline">Library/(Application Support|Containers|Group Containers)</field>
    <description>CVE-2026-65345 heuristic: process from user-writable path accessing protected user data (CWE-284 permission bypass class)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_65345,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source (NVD) asserts the fix; not independently confirmed against the Apple advisory).

1. Immediate mitigations. Until verified patching, reduce exposure by restricting app installation to trusted sources, disabling sideloading and unmanaged enterprise app distribution where policy permits, and reviewing which applications hold access to sensitive user data. Enforce application allowlisting on managed macOS and iOS fleets so only vetted binaries execute. Because the trigger requires an app plus user interaction (UI:R), user awareness — cautioning against installing unvetted apps — meaningfully lowers near-term risk. No vendor-published CVE-specific workaround is available; none should be invented.

2. Patch / upgrade steps. Apply the vendor patches that resolve the issue:

   • iOS 26.7 and iPadOS 26.7 (and iOS 27 / iPadOS 27 for the newer branch)
   • macOS Golden Gate 27
   • macOS Sequoia 15.8
   • macOS Tahoe 26.7 Confirm the fix against the official Apple security advisory and the NVD entry before closing remediation tickets, given the CLAIMED patch-confidence level. Prioritize internet-facing and executive/high-value endpoints, and any device known to run sideloaded or third-party-distributed apps.

3. Long-term hardening. Enforce MDM-managed update compliance and minimum-version baselines across Apple endpoints; deploy EDR capable of surfacing sandbox and consent-bypass anomalies; monitor for untrusted apps reaching protected data paths; maintain a vulnerability-management process that treats Apple permission-bypass CVEs as routine-priority patches even absent public exploits; and conduct periodic reviews of TCC/permission grants on high-value endpoints.

References

• NVD — CVE-2026-65345: https://nvd.nist.gov/vuln/detail/CVE-2026-65345
• Apple Security Releases (vendor advisory portal for iOS/iPadOS/macOS updates): https://support.apple.com/en-us/HT201222
• CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-65345 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS — CVE-2026-65345 scoring data: https://api.first.org/data/v1/epss?cve=CVE-2026-65345

Threat actor campaign notes: no named threat actor, exploit-in-the-wild evidence, public PoC, or KEV listing is associated with CVE-2026-65345 in the provided data. EPSS is 0.00170 (approximately 6.7th percentile), indicating low predicted exploitation activity at the time of writing.