macOS autofs path traversal is CVE-2026-84568
Apple patched CVE-2026-84568 in the autofs component on 14 September 2026 in macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. A hostile network directory server may reach arbitrary code execution as root. CISA ADP scores CVSS 3.1 7.8. Not in CISA KEV. A third-party lab PoC is linked; ThreatWire has not run it.
Published 12 Oct 2026 · Updated 12 Oct 2026
What happened
On 14 September 2026 Apple released macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Each security note lists CVE-2026-84568 under the autofs component. Apple’s Impact text says an attacker with control of a network directory server may be able to execute arbitrary code with root privileges. The Description is that a path traversal issue was addressed with improved path validation. Apple credits Mr.Gedik (@h4ck2s3c) of Turkish Technology.
The same autofs section also lists CVE-2026-84570, a separate Gatekeeper-bypass issue credited to the same researcher. This article is only about CVE-2026-84568.
Apple did not publish a CVSS score. NVD carries CVSS 3.1 7.8 (High) from CISA ADP (Secondary), with CWE-22 from the same Secondary source, and marks the record Analyzed.
Who is affected
Per Apple and the CVE record, systems were vulnerable before:
- macOS Golden Gate 27
- macOS Sequoia 15.8
- macOS Tahoe 26.7
NVD’s CPE matches cover Sequoia 15.x before 15.8 and Tahoe 26.x before 26.7; Apple’s Golden Gate 27 advisory is the third fixed train. ThreatWire found no Apple security notes for iOS, iPadOS, visionOS, or watchOS under this CVE ID.
Practical exposure depends on using automount maps from a network directory service (for example LDAP, NIS, or Open Directory) that an attacker can control or spoof. Hosts that never consume untrusted automount maps from a directory server are outside the attacker model Apple describes.
What is confirmed
Apple’s three advisories confirm the component name (autofs), the path-traversal remediation wording, the root-code-execution impact when a network directory server is controlled, the three fixed macOS versions, the 14 September 2026 release date, and the credit to Mr.Gedik (@h4ck2s3c) of Turkish Technology.
NVD confirms publication on 14 September 2026, the CISA ADP CVSS 7.8 score, CWE-22, and the three Apple Support URLs as references.
The CVE is not in the CISA KEV catalog (catalog version 2026.10.08). ThreatWire found no dedicated articles from BleepingComputer, The Record, SecurityWeek, or The Hacker News focused on CVE-2026-84568. No primary technical write-up from the credited researcher was located for citation.
A third-party GitHub account not affiliated with the credited researcher (redinpulse, repository created 10 October 2026) published a repository claiming lab proofs for CVE-2026-84568 and CVE-2026-84570, including root code execution. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs.
What is not confirmed
Exploitation in the wild is not claimed by Apple or CISA.
ThreatWire has not independently reproduced the third-party lab material linked from this record. Whether that repository fully matches Apple’s fixed path on every build remains unverified here.
Claims that every Mac is remotely exploitable without a hostile or compromised directory-server relationship overstate Apple’s published attacker model.
What to do
Update macOS to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 (or later on those lines) through Software Update.
Audit which Macs bind to network directory services and which automount maps they receive. Restrict directory-service traffic to trusted, authenticated servers. Treat a compromised directory server as a root-level risk to clients that still consume vulnerable automount paths until those clients are patched.
Sources: Apple Support 149035 (Golden Gate 27), 149042 (Tahoe 26.7), 149043 (Sequoia 15.8); NVD and CVE.org for CVE-2026-84568; CISA KEV catalog 2026.10.08 (not listed).