CVE-2026-84568
macOS autofs path traversal from network directory server
Apple fixed a path traversal in the macOS autofs component so that an attacker who controls a network directory server may execute arbitrary code as root. Fixed in macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 on 14 September 2026. CISA ADP scores CVSS 3.1 7.8. Not in CISA KEV. A third-party lab PoC repository is linked; ThreatWire has not run it.
- CVSS
- 7.8
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Apple
- Products
- macOS Golden Gate, macOS Sequoia, macOS Tahoe, autofs
- Affected
- macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS before Golden Gate 27, per Apple and the CVE record. Apple lists the issue under autofs.
- Fixed
- macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, released 14 September 2026.
- CWE
- CWE-22
- Published
- 14 Sept 2026
- Updated
- 12 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-84568 is listed under the autofs component in Apple’s security notes for macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7, all released on 14 September 2026. Apple’s Impact line says an attacker with control of a network directory server may be able to execute arbitrary code with root privileges. The Description is that a path traversal issue was addressed with improved path validation. Apple credits Mr.Gedik (@h4ck2s3c) of Turkish Technology.
Apple did not publish a CVSS score. NVD records CVSS 3.1 7.8 (High) with vector in the fiche field, from CISA ADP as a Secondary metric, and maps the issue to CWE-22. NVD marks the entry Analyzed. The CVE record and Apple notes list only macOS; ThreatWire found no iOS, iPadOS, or other Apple platform advisories for this ID.
The same September releases also list CVE-2026-84570 under autofs (Gatekeeper bypass, same researcher). This record covers only CVE-2026-84568.
The CVE is not in the CISA KEV catalog (checked against catalog 2026.10.08). ThreatWire found no dedicated write-ups from BleepingComputer, The Record, SecurityWeek, or The Hacker News focused on this CVE. No researcher primary write-up from the credited reporter was found for citation.
A third-party GitHub account not affiliated with the credited researcher (redinpulse, repository created 10 October 2026) published a repository claiming lab proofs for CVE-2026-84568 and CVE-2026-84570, including root code execution. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs. The PoC link field on this record points to that repository; the URL is not repeated in the body.