CVE-2026-65375

Executive Summary

CVE-2026-65375 is an improper authentication vulnerability (CWE-287) in Apple macOS, addressed through "improved authentication" logic, that allows an application to cause unexpected system termination. Affected platforms are macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.6, and macOS Golden Gate prior to 27. The CVSS 3.1 base score is 7.5 (HIGH), driven entirely by a high availability impact (A:H) with no confidentiality or integrity impact, indicating a denial-of-service class defect localized to macOS authentication handling.

Technical Analysis

The vulnerability is classified as CWE-287: Improper Authentication. Apple's description states the issue "was addressed with improved authentication," meaning the defect resides in an authentication decision point within macOS. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates the flaw is network-reachable, requires no privileges and no user interaction, is scoped to the vulnerable component, and results in a high availability impact only. Critically, there is no confidentiality or integrity impact, so the flaw is not a credential-bypass-to-data-access issue — it is an authentication processing weakness that can be driven into a state causing unexpected system termination (kernel panic, system daemon crash, or forced restart class of behavior).

The exact authentication mechanism, the specific subsystem (e.g., whether it involves a network authentication service, a local privilege boundary, or an IPC authentication check), the malformed input that triggers the failure, and the code path involved are NOT specified in the NVD description or CNA title. No public PoC, exploit code, or Nuclei template exists. Therefore, all statements below are derived strictly from the vulnerability class (improper authentication leading to availability loss) and must not be read as confirmation of specific implementation details.

CWE-287 improper-authentication defects that produce availability-only impact typically manifest when a component fails to validate the identity or state of a calling process/service correctly, and subsequently mishandles the inconsistent authentication state (for example, dereferencing an unvalidated session context or processing a request against an unauthenticated state). In macOS, such classes of defects have historically surfaced in networking daemons and system services exposed to network input. Because the patch notes are sparse and single-sourced, the attack surface should be treated as the macOS authentication stack broadly, with the network-reachability (AV:N) and no-privilege requirement (PR:N) as the strongest technical signals.

The "no user interaction" (UI:N) characteristic is notable: an attacker does not need to trick a logged-in user into clicking or approving anything. Combined with AV:N, this suggests the triggering input can be delivered remotely to an exposed authentication endpoint or service, and the resulting crash is not gated on any interactive consent.

Exploitation Scenarios

Because no public exploit or PoC exists, the following chain is inferred at the vulnerability-class level only. No specific function names, endpoints, ports, or parameters are asserted.

1. Reconnaissance / target identification: An adversary enumerates hosts running vulnerable macOS versions — macOS Sequoia below 15.8, macOS Tahoe below 26.6, or macOS Golden Gate below 27. macOS endpoints with network-exposed authentication services are prioritized, consistent with the AV:N vector. Fingerprinting is performed against advertised macOS build/version information and reachable network services.

2. Triggering the flaw class: The attacker sends crafted authentication-related input to a macOS authentication decision point that implements the flawed authentication logic. The input is designed to place the authentication handler into an inconsistent or unhandled state. Because CWE-287 describes improper authentication, the trigger is an authentication request that the component fails to validate or process correctly, rather than a memory-corruption payload.

3. Payload / execution method: This is a remote, unauthenticated, no-interaction class of attack. No code execution is expected — the payload is malformed or unexpected authentication traffic. No named functions, classes, URLs, or parameters can be provided because none are specified in the source data.

4. Post-exploitation impact: The malformed authentication processing drives the affected component into "unexpected system termination," i.e., a crash, restart, or denial-of-service condition on the macOS host. The impact is availability-only: no data exposure and no modification of data is indicated by the CVSS subscores. An attacker could repeatedly deliver triggering authentication input to sustain a denial-of-service condition against the endpoint.

Impact Assessment

• CVSS 3.1 Base: 7.5 (HIGH) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
• Attack Vector (Network): triggerable from the network; the host must expose the relevant authentication surface.
• Attack Complexity (Low): no special conditions are indicated.
• Privileges Required (None): no authentication needed to attempt the trigger.
• User Interaction (None): no victim action required.
• Scope (Unchanged): impact is confined to the vulnerable component.
• Confidentiality (None) / Integrity (None): no data compromise is indicated.
• Availability (High): unexpected system termination can render the host or service unavailable.
• EPSS: 0.00201 (approximately the 10.3rd percentile), indicating low near-term exploitation likelihood based on current public signals.
• CISA KEV: Not listed — no confirmed in-the-wild exploitation as of publication.
• Blast radius: Individual macOS endpoints or any network service dependent on the affected authentication component. In managed fleets, an attacker with network access could target many unpatched macOS systems, but the availability-only impact limits damage to service disruption rather than data theft.

Detection Guidance

Note: Because the specific trigger traffic, subsystem, and crash signature are not published, the rules below are generalized for improper-authentication / availability-impact detection and should be tuned to the environment. They target anomalous authentication traffic patterns and unexpected system termination of macOS services.

Sigma Rule

title: macOS Unexpected System Termination / Auth Handler Crash (CVE-2026-65375)
id: 6b2f9d1a-4c3e-4f7b-9a21-000065375abc
status: experimental
description: Detects unexpected termination of macOS authentication-related processes and forced restart events potentially related to CVE-2026-65375.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65375
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: macos
  category: process_creation
detection:
  selection_crash:
    EventID:
      - 99
      - 100
    Message|contains:
      - 'authentication'
      - 'authd'
  selection_panic:
    Message|contains:
      - 'panic'
      - 'unexpected termination'
  condition: selection_crash or selection_panic
falsepositives:
  - Legitimate crashes of authentication daemons
  - Kernel panics from hardware faults
level: medium
tags:
  - attack.t1499
  - cve.2026.65375

YARA Rule

rule CVE_2026_65375_macOS_Availability
{
    meta:
        description = "Heuristic detection for CVE-2026-65375 exploitation artifacts (macOS improper authentication DoS). Generic class-based rule."
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65375"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "CVE-2026-65375" ascii nocase
        $b = "authentication" ascii nocase
        $c = "unexpected system termination" ascii nocase

    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-65375 macOS improper authentication pattern (potential DoS)"; flow:to_server,established; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-65375; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65375; sid:90065375; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and process.name : ("authd", "securityd") ]
  [ process where event.action == "terminated" and process.exit_code != 0 ]

Splunk SPL Query

index=macos sourcetype=macos:system (Message="*authentication*" OR Message="*panic*" OR Message="*unexpected termination*")
| stats count values(Message) as messages by host, process_name
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="macos,cve-2026-65375,">
  <rule id="100375" level="10">
    <decoded_as>macos</decoded_as>
    <match>authentication|unexpected system termination|panic</match>
    <description>CVE-2026-65375: macOS authentication component unexpected termination / crash indicator</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_65375,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source via NVD claims a fix; not independently confirmed).

1. Immediate mitigations:

• Reduce network exposure of macOS authentication services (restrict inbound access via firewall/segmentation) to limit AV:N reachability.
• Monitor for repeated crash/panic events tied to authentication processes and investigate spikes as potential denial-of-service activity.
• Since there is no public PoC, prioritize based on asset criticality and network exposure rather than active exploitation signals.

2. Patch / upgrade steps:

• Upgrade to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.6 (the versions listed as fixed).
• Verify OS build versions across managed fleets via MDM and confirm remediation.
• Because the patch claim is single-sourced, validate that the fixed version is actually installed and test for regression of authentication functionality.

3. Long-term hardening:

• Maintain automated macOS patch management and enforce version baselines.
• Minimize network-reachable authentication surfaces on endpoints.
• Retain and forward macOS unified logs / crash reports to central SIEM for availability-incident correlation.
• Track vendor advisories for confirmation of the fix and re-classification if new details emerge.

References

1. NVD — CVE-2026-65375: https://nvd.nist.gov/vuln/detail/CVE-2026-65375
2. Apple Security Releases (vendor advisory portal): https://support.apple.com/en-us/HT201222
3. CWE-287: Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
4. CISA KEV Catalog (not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (score 0.00201): https://www.first.org/epss

Threat actor campaigns / exploit-in-the-wild: No known campaigns or in-the-wild exploitation evidence. CISA KEV: NO. EPSS 0.00201 (~10.3rd percentile). No public PoC, exploit code, or Nuclei template available at time of publication.