CVE-2026-86902: 
macOS vulnerability analysis and mitigation

CVE-2026-86902 is a directory path parsing vulnerability in the NSDocument component of macOS that allows an installed application to access sensitive user data. The flaw stems from improper path validation when handling directory paths, and was addressed with improved path validation logic. It affects macOS Sonoma versions prior to 14.8.8 and macOS Golden Gate versions prior to 27. Apple disclosed and patched the vulnerability on September 14, 2026 (with the Sonoma fix backported and released July 27, 2026). The CVSS base score is estimated as Medium; the EPSS score is 0.0 (Apple Advisory Sonoma, Apple Advisory Golden Gate, Github Advisory).

The vulnerability is rooted in a parsing flaw (CWE not formally assigned) within the NSDocument component's handling of directory paths, where insufficient path validation allows an application to traverse or reference paths outside its intended scope. An attacker-controlled app running on the affected system can craft directory path inputs that bypass the validation controls, enabling access to sensitive user data directories. Exploitation requires a malicious app to be installed and executed on the target system — no network access or elevated privileges are needed as a precondition. No public technical write-ups or proof-of-concept code have been identified (Apple Advisory Sonoma, Apple Advisory Golden Gate).

Successful exploitation allows a malicious application to read sensitive user data that it would not normally be permitted to access, representing a confidentiality breach. Integrity and availability are not directly impacted by this vulnerability. The scope is limited to the local system where the malicious app is installed, with no evidence of lateral movement potential; however, exposed user data (e.g., documents, credentials, or personal files accessible via NSDocument paths) could be leveraged for further attacks (Apple Advisory Sonoma, Apple Advisory Golden Gate).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Apple Advisory Golden Gate).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.8 (released July 27, 2026) and macOS Golden Gate 27 (released September 14, 2026). Users should update their macOS installations to these versions or later via System Settings > Software Update. No configuration-based workarounds have been published; upgrading to a patched version is the only recommended remediation. Additionally, reviewing installed applications for suspicious access patterns to sensitive user data directories is advised (Apple Advisory Sonoma, Apple Advisory Golden Gate).