Description
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information.
Published: 2026-10-20
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Update macOS
AI Analysis

Impact

The vulnerability permits an application running on macOS to read network connection data that should not be exposed. This flaw enables the disclosure of sensitive information stored within the system’s network configuration, potentially compromising user privacy without requiring remote execution.

Affected Systems

Apple macOS versions prior to macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 are affected. Users on these releases should update to the specified versions or higher where the issue has been corrected.

Risk and Exploitability

The CVSS score is 5.5, indicating a moderate risk to confidentiality. The EPSS score is 0.00162, indicating very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed.

Generated by OpenCVE AI on October 20, 2026 at 18:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the macOS update to at least Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 to receive the fix.
  • Configure the macOS Firewall to restrict inbound and outbound traffic for applications that do not require extensive network access, reducing the potential exposure of connection data.
  • Audit and remove unnecessary or outdated network credentials from Keychain and system network settings to limit the amount of sensitive data available to applications.

Generated by OpenCVE AI on October 20, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 20 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Title macOS Vulnerability Allows Applications to Access Sensitive Network Connection Information

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title macOS Vulnerability Allows Applications to Access Sensitive Network Connection Information
Weaknesses CWE-200

Tue, 20 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Tue, 20 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-10-26T20:39:13.052Z

Reserved: 2026-09-08T16:43:41.875Z

Link: CVE-2026-86914

cve-icon Vulnrichment

Updated: 2026-10-20T14:06:53.135Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T01:17:27.000

Modified: 2026-11-03T21:01:02.540

Link: CVE-2026-86914

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T19:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor