Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-64702: sandbox escape in Apple macOS

A malicious or vulnerable app can break out of the macOS application sandbox, allowing local code to gain broader privileges on the system; see CVE-2026-64702. The issue affects macOS Sonoma 14.x before 14.8.8, macOS Sequoia 15.x before 15.7.8, and macOS Tahoe 26.x before 26.6. Exploitation requires an app running on the affected macOS host.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00541
CWE
CWE-284
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgently install the vendor fixes: this is a critical (CVSS 9.8) sandbox-escape bug that lets an app escalate beyond its sandbox; apply the listed macOS updates immediately.

What is CVE-2026-64702?

A malicious or vulnerable app can break out of the macOS application sandbox, allowing local code to gain broader privileges on the system; see CVE-2026-64702. The issue affects macOS Sonoma 14.x before 14.8.8, macOS Sequoia 15.x before 15.7.8, and macOS Tahoe 26.x before 26.6. Exploitation requires an app running on the affected macOS host.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Apple macOS are affected?

BRANCHAFFECTEDFIXED
14.xbefore 14.8.814.8.8
15.xbefore 15.7.815.7.8
26.xbefore 26.626.6

Is CVE-2026-64702 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-64702

  1. Install the vendor updates that fix the issue: 14.8.8, 15.7.8, or 26.6 as appropriate for your macOS release.
  2. Block untrusted or unnecessary apps from running and restrict software installation to managed channels.
  3. Monitor endpoints for unusual privilege escalation and audit application behavior for sandbox violations.
  4. Apply the vendor's additional guidance and configuration recommendations for app sandboxing and containment.

Frequently asked questions

Is CVE-2026-64702 being actively exploited?

There are no public reports of exploitation of CVE-2026-64702 as of 2026-09-29.

Which macOS versions are affected by CVE-2026-64702?

macOS Sonoma 14.x before 14.8.8, macOS Sequoia 15.x before 15.7.8, and macOS Tahoe 26.x before 26.6 are affected.

Is there a patch for CVE-2026-64702?

Yes. Apple fixed the issue in macOS Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6—install the appropriate update.

Does CVE-2026-64702 require authentication?

Exploitation involves an app escaping its sandbox, so it requires an app to run on the macOS host rather than remote authentication.

References