CVE-2026-39875PoC(apple / macos)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch apple macos systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

apple CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://github.com/mac-123456789-lab/CVE-2026-39875-macOS-CUPS-LPE

Weakness type (CWE)

CWE-276

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

macos

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
9 mentions across 7 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 7 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-08-03); latest day: 1
9 total mentions across 7 days

Affected systems

Vendors

apple

Products

macos

Deep dive

Activity timeline9 mentions / 7d

Signal classification3 categories

PoC

777.8%

Exploit

111.1%

Disclosure

111.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	1	PoC1
2026-07-29	1	PoC1
2026-07-30	1	PoC1
2026-08-03	2	PoC2
2026-08-04	2	Exploit1PoC1
2026-08-05	1	PoC1
2026-10-03	1	Disclosure1

Full discourse9 posts

Daily CyberSecurity@Daily_CyberSec85d
PoC
Details and PoC exploit code for CVE-2026-39875 are now public. This macOS privilege escalation flaw lets a malicious app gain root. Patch now. #CVE202639875 #macOS #PrivilegeEscalation #CUPS #Apple #PoC #InfoSec #CyberSecurity http://securityonline.info/cve-2026-39875-macos-root/
Post summary
A public PoC exploit for CVE-2026-39875, enabling root privilege escalation on macOS, is available and a patch has been released.
114063254.0K
13.0K followersView on X
dbugs@ptdbugs92d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-39875 PT ID: PT-2026-65134 Vendor: Apple Product: macOS Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-65134 • https://github.com/mac-123456789-lab/cve-2026-39875-macos-cups-lpe #dbugs_vuln
Post summary
A PoC and exploit for CVE-2026-39875 demonstrating a permissions-based privilege escalation on macOS has been disclosed, but the vulnerability is already addressed in the latest OS releases.
112052157.8K
3.5K followersView on X
elhacker.NET@elhackernet84d
PoC
Publican PoC de vulnerabilidad en CUPS en MacOS para obtener privilegios de root Se ha publicado una prueba de concepto (PoC) pública para la vulnerabilidad CVE-2026-39875 en el sistema de impresión CUPS de macOS https://blog.elhacker.net/2026/08/publican-poc-de-vulnerabilidad-en-cups.html
Post summary
A proof‑of‑concept exploit for CVE‑2026‑39875 in the CUPS print system on macOS has been publicly released, but there is no indication of active exploitation or available patches.
01403774.8K
142.4K followersView on X
Es Geeks@EsGeeks84d
Exploit
⚠️ PoC público para CVE-2026-39875: usuario local escribe archivos como root vía CUPS en macOS. Parches ya disponibles (14.8.8 / 15.7.8 / 26.6). ⚠️ NO ejecutes el script en tu máquina principal. Solo en laboratorio. Fuente: http://github.com/mac-123456789-lab/CVE-2026-39875-macOS-CUPS-LPE #macOS #CVE #Ciberseguridad https://t.co/bk6lZTpIUT
Post summary
A public PoC and exploit script for CVE‑2026‑39875, enabling local privilege escalation on macOS via CUPS, is shared along with available patch versions. Users are cautioned to run the script only in lab environments.
010152792
22.5K followersView on X
Jurre van Bergen@DrWhax89d
PoC
I was looking at https://github.com/mac-123456789-lab/CVE-2026-39875-macOS-CUPS-LPE and my clanker found a technique that's now closed off but similar to used in that bug report. Apologies for the long video, you can skip through most of it ;-) https://t.co/aKg2xqe5N7
Post summary
A GitHub repository with a proof‑of‑concept for CVE‑2026‑39875 is referenced, indicating exploit code availability, but no evidence of active exploitation or patching is mentioned.
12054957
5.0K followersView on X
IntegSec@integ_sec24d
Disclosure
CVE-2026-39875: macOS CUPS Privilege Escalation Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04z5Sbj0
Post summary
The text is a disclosure announcement for CVE‑2026‑39875, highlighting a macOS CUPS privilege escalation bug, without referencing PoC, exploit tools, active exploitation, or a patch.
1001050
35 followersView on X
キタきつね@foxbook85d
PoC
CVE-2026-39875: 公開された概念実証により、悪意のあるmacOSアプリがルート権限を取得できる CVE-2026-39875: Public PoC Lets a Malicious macOS App Gain Root Privileges #DailyCyberSecurity (Aug 3) https://securityonline.info/cve-2026-39875-macos-root/
Post summary
The post announces a publicly disclosed proof‑of‑concept that allows a malicious macOS application to obtain root privileges, with no code details, exploitation evidence, or patch mention in the text.
00002283
4.9K followersView on X
moton@moton85d
PoC
CVE-2026-39875: macOS Privilege Escalation PoC Public - https://securityonline.info/cve-2026-39875-macos-root/
Post summary
A public Proof of Concept for CVE-2026-39875, a macOS privilege escalation vulnerability, is available via the provided link, with no evidence of active exploitation or mitigation discussed.
00000102
719 followersView on X
Rıdvan Yağlı@ridvanyagli91d
PoC
macOS CUPS bileşenini etkileyen LPE açığı CVE-2026-39875 için PoC yayınlandı. https://github.com/mac-123456789-lab/cve-2026-39875-macos-cups-lpe
Post summary
A proof‑of‑concept for the LPE vulnerability CVE‑2026‑39875 affecting macOS CUPS has been published on GitHub. The announcement includes no active exploitation or patch information.
00000189
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-

Explore more

Back to dashboard apple CVEs macos vulnerabilities

What researchers are saying

CVE-2026-39875

dbugs[verified]@ptdbugsPoC

A PoC and exploit for CVE-2026-39875 demonstrating a permissions-based privilege escalation on macOS has been disclosed, but the vulnerability is already addressed in the latest OS releases.

IntegSec[verified]@integ_secDisclosure

The text is a disclosure announcement for CVE‑2026‑39875, highlighting a macOS CUPS privilege escalation bug, without referencing PoC, exploit tools, active exploitation, or a patch.

キタきつね[verified]@foxbookPoC

The post announces a publicly disclosed proof‑of‑concept that allows a malicious macOS application to obtain root privileges, with no code details, exploitation evidence, or patch mention in the text.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A proof‑of‑concept for the LPE vulnerability CVE‑2026‑39875 affecting macOS CUPS has been published on GitHub. The announcement includes no active exploitation or patch information.

Daily CyberSecurity@Daily_CyberSecPoC

A public PoC exploit for CVE-2026-39875, enabling root privilege escalation on macOS, is available and a patch has been released.

elhacker.NET@elhackernetPoC

A proof‑of‑concept exploit for CVE‑2026‑39875 in the CUPS print system on macOS has been publicly released, but there is no indication of active exploitation or available patches.

Es Geeks@EsGeeksExploit

A public PoC and exploit script for CVE‑2026‑39875, enabling local privilege escalation on macOS via CUPS, is shared along with available patch versions. Users are cautioned to run the script only in lab environments.

Jurre van Bergen@DrWhaxPoC

A GitHub repository with a proof‑of‑concept for CVE‑2026‑39875 is referenced, indicating exploit code availability, but no evidence of active exploitation or patching is mentioned.