Critical macOS Security Flaw Identified
A high-severity security vulnerability affecting Apple's operating system, tracked as CVE-2026-43760, has been addressed by the company. The flaw, which allowed for remote code execution (RCE) with root-level privileges, was discovered on macOS 26.5.2 systems powered by M4 and M5 Apple Silicon chips, even with System Integrity Protection (SIP) active.
Technical Details of the Exploit
According to security research firm Bynario, the vulnerability is triggered through specific configurations involving remote access features. Devices are susceptible if they have Screen Sharing or Remote Management enabled in conjunction with the legacy setting labeled "VNC viewers may control screen with password."
If an unauthorized party gains access to the VNC password, they can perform file-transfer operations that bypass standard account security. Because of a logic flaw, the system permits these operations with root permissions. The researchers noted the severity of the issue, stating:
«The attacker would be able to create new files owned by root anywhere the system allows.»
By exploiting this, an attacker could inject files into directories like /private/etc/sudoers.d to gain passwordless sudo privileges, effectively allowing them to run arbitrary commands as the root user.
Reporting Challenges and AI Overload
The discovery process encountered significant hurdles. Due to a massive volume of low-quality, AI-generated vulnerability reports, Apple implemented strict limits on the number of active submissions a single researcher could maintain. Bynario had reached this limit after submitting over 50 bugs in a three-week period, which temporarily blocked them from filing this specific RCE report.
Ultimately, Apple initiated direct contact with the research team to investigate the claim. The vulnerability, which carries a high severity score of 8.6 out of 10, was officially addressed in updates released on July 27, 2026.
Recommended Actions for Users
Users are encouraged to update their systems to the following versions to secure their devices:
- macOS Tahoe 26.6
- macOS Sonoma 14.8.8
For those unable to update immediately, Bynario suggests disabling the legacy VNC password option or turning off Screen Sharing and Remote Management entirely to mitigate the risk.