CVE-2026-86868
Apple macOS
- Apple macOS
- Critical
- CVSS 9.1
- EPSS 0.2%
- Fixed version listed
Summary
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.
From the CVE record.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Apple macOS | before 15.8; before 26.7; before 27 | 27 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1, scored by CISA-ADP)
- EPSS
- 0.2% chance of exploitation in the next 30 days (EPSS from FIRST, as of Oct 29, 2026)
- CISA's SSVC decision points
- Exploitation: none. Automatable: yes. Technical impact: total. As of Oct 29, 2026.
- Weakness
- CWE-287: Improper Authentication
- Vendor
- Apple, macOS
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.