CVE-2026-398757.8High

CVE-2026-39875: Apple macOS vulnerability

Apple · macOS

Vendor fix available · Affected: Apple macOS · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub27 Jul
Not established: not seen

0.1%probability of exploitation in the next 30 days

4th percentile

050100

Higher than 4% of scored CVEs

7.8HighCVSS

LowMediumHighCrit.

DescriptionNVD

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Incorrect Default Permissions · Access Control
Vendor: Apple
Published: July 2026
Band: Unlikely (under 1%), July 2026

What changed

27 Jul
PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 3 Aug.

3 Aug 15:23
Apple patches CUPS flaw CVE‑2026‑39875 enabling root access
SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.