CVE-2026-84568PoC(apple / macos)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (5 latest mentions)

Immediate actions

Patch apple macos systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges.

apple CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-22

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

macos

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
14 mentions across 5 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 4 signals
PoC mentioned or linked in 10 signals
Patch or workaround mentioned in 10 signals
Technical details provided in 11 signals
Disclosure: 2 classified signals
Peaked at 5 mentions on most recent observed day (2026-10-27)
14 total mentions across 5 days

Affected systems

Vendors

apple

Products

macos

Deep dive

Activity timeline14 mentions / 5d

Signal classification4 categories

PoC

861.5%

Disclosure

215.4%

Exploit

215.4%

General

17.7%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	2	Disclosure2
2026-10-11	2	General1PoC1
2026-10-12	4	Exploit2PoC2
2026-10-18	1	PoC1
2026-10-27	5	PoC4

Full discourse14 posts

Mr.Gedik@h4ck2s3c46d
Disclosure
Apple macOS tespit ettiğim, son altı yıl içinde yayımlanan tüm sürümleri etkileyen ve kurumsal ağlarda zero-click RCE’ye yol açabilen zafiyetim, iki ayrı CVE kimliğiyle duyuruldu: CVE-2026-84570 ve CVE-2026-84568. https://support.apple.com/en-us/149035 https://t.co/0dBe2UBk42
Post summary
The author discloses their discovery of a zero-click RCE vulnerability in macOS affecting six years of versions, now assigned CVE-2026-84570 and CVE-2026-84568, with links to the Apple advisory and further details.
111821704118.0K
2.0K followersView on X
Mr.Gedik@h4ck2s3c19d
General
https://github.com/redinpulse/CVE-2026-84568
Post summary
The text is only a GitHub URL containing a CVE identifier. It provides no clear information about a PoC, exploit, exploitation activity, remediation, or vulnerability details.
34084458.5K
2.0K followersView on X
!Manan@0xManan12d
PoC
Your LDAP map just became root on the Mac. CVE-2026-84568 : automountd treats directory-controlled `fstype` as a helper pathname. `nfs/../../../home/<key>/p` escapes `/sbin/mount_*` → `posix_spawn` of an NFS-delivered binary as root. Chain: poison automount/homeurl → NFS delivery → fstype traversal → root exec. Sibling CVE-2026-84570: directory `dev` option strips `nodev` + Gatekeeper misses ad-hoc apps from that NFS mount. Apple fixed Sep 14 (Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27). Public lab PoC + writeup landed Oct 10. https://github.com/redinpulse/CVE-2026-84568 Directory write ≠ client root… until automountd makes it so. #InfoSec #macOS #Apple #PrivilegeEscalation
Post summary
A tweet announcing CVE-2026-84568, a macOS privilege escalation via automountd fstype traversal, with a public PoC linked on GitHub and Apple patches in Sequoia 15.8/Tahoe 26.7/Golden Gate 27 noted. The main takeaway is the sharing of the PoC and its technical writeup.
13024141.3K
2.3K followersView on X
dbugs@ptdbugs18d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-84568 PT ID: PT-2026-91625 Read on dbugs: https://dbu.gs/vulnerability/PT-2026-91625 Vendor: Apple Product: macOS Description: A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges. Link: https://github.com/redinpulse/cve-2026-84568
Post summary
The post announces a discovered PoC/exploit for CVE-2026-84568 and links to a GitHub repository. It also describes the path traversal impact and lists fixed macOS versions; no active exploitation is reported.
1102051.6K
3.7K followersView on X
Rıdvan Yağlı@ridvanyagli20d
PoC
🔴 CVE-2026-84568 için macOS autofs bileşenine yönelik yayınlanan bazı reverse engineering analizi ve PoC'ler. Apple tarafından path traversal olarak tanımlanan açık, ağ dizin sunucusunu kontrol eden bir saldırganın root yetkileriyle keyfî kod çalıştırmasına olanak sağlayabilir. PoC, savunmasız automountd servisinin kötü amaçlı LDAP kayıtları üzerinden sistemin kendi NFS kaynağını 127.0.0.1 üzerinden bağlamasını gösteriyor. Ancak PoC, doğrudan RCE veya privilege escalation gerçekleştirmiyor. Etkilenen sürümler: macOS Sequoia 15.8 öncesi, Tahoe 26.7 öncesi ve Golden Gate 27 öncesi. Düzeltme: Sequoia 15.8, Tahoe 26.7 ve Golden Gate 27. PoCs: https://github.com/jvidhan/autofs-cve-2026-84568 https://github.com/redinpulse/CVE-2026-84568
Post summary
Metin, macOS autofs açığı için teknik ayrıntıları ve iki PoC bağlantısını paylaşıyor; PoC'nin doğrudan RCE veya privilege escalation sağlamadığı özellikle belirtiliyor. Ayrıca etkilenen sürümler ve düzeltme sürümleri listelenmiş.
120101806
2.5K followersView on X
ThreatWire@ThreatWire_18d
PoC
🧪 PoC RELEASED — macOS CVE-2026-84568 CVSS 3.1: 7.8 (CISA ADP) A public GitHub repo now claims lab proofs for this autofs path traversal, including root code execution. It also claims CVE-2026-84570. ⚠️ Published by a third-party account, not the credited researcher. ThreatWire has not run or verified it. Test only in an isolated lab. The bug: an attacker who controls a network directory server may run code as root on Macs that use it. ✅ Fixed (Sep 14): • macOS Golden Gate 27 • macOS Tahoe 26.7 • macOS Sequoia 15.8 Credit: Mr.Gedik (@h4ck2s3c), Turkish Technology • Not in CISA KEV • No known exploitation Patch now, especially managed Macs bound to directory services. Full breakdown 👇 https://www.threatwire.tech/news/macos-autofs-path-traversal-is-cve-2026-84568 #macOS #Apple #CVE #PoC #CyberSecurity #Infosec #PatchNow
Post summary
A third-party GitHub PoC for macOS CVE-2026-84568 (autofs path traversal with root code execution) has been released, with patches available for recent macOS versions and no known active exploitation in the wild.
100111658
1.9K followersView on X
kokumօtօ@__kokumoto3d
PoC
macOSのautofsにおける脆弱性CVE-2026-84568及びCVE-2026-84570に対応するPoC（攻撃の概念実証コード）と技術詳細が公表。前者はディレクトリサーバを制御する攻撃者によるroot権限でのコード実行で、後者はGatekeeper迂回。9/14修正済みのもの。 https://securityonline.info/macos-autofs-vulnerability-cve-2026-84568-poc/
Post summary
このテキストでは、2つのmacOS autofs脆弱性（CVE-2026-84568とCVE-2026-84570）のPoCコードと技術詳細が公開されていることが報告されています。前者はディレクトリサーバを制御する攻撃者によるroot権限でのコード実行で、後者はGatekeeper迂回に関するものです。パッチは9月14日にリリースされました。
010441.1K
8.0K followersView on X
Daily CyberSecurity@Daily_CyberSec4d
PoC
PoC and details are public for CVE-2026-84568, a macOS autofs vulnerability enabling root code execution, and a Gatekeeper bypass. Update macOS now. #macOS #Apple #CVE202684568 #CVE202684570 #Gatekeeper #autofs #PoC #CyberSecurity https://securityonline.info/macos-autofs-vulnerability-cve-2026-84568-poc/
Post summary
Proof of Concept code and details are publicly disclosed for CVE-2026-84568, a macOS autofs vulnerability enabling root code execution and Gatekeeper bypass, with an accompanying call to update macOS immediately.
00141432
13.1K followersView on X
ExploitGrid@exploitgrid18d
PoC
⚠️ Public exploit for CVE-2026-84568: macOS path traversal may enable root-level code execution under specific conditions. CVSS 7.8. ExploitGrid: 39.3/100. Fixed in Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. 🔎 https://exploitgrid.net
Post summary
The text announces a publicly available exploit for CVE-2026-84568, a macOS path traversal vulnerability that may lead to root-level code execution (CVSS 7.8), with patches released in Sequoia 15.8, Tahoe 26.7, and Golden Gate 27.
00042345
404 followersView on X
ExploitGrid@exploitgrid18d
Exploit
⚠️ CVE-2026-84568: Public exploit available for a macOS path traversal that may lead to root-level code execution under specific conditions. CVSS 7.8; ExploitGrid 39.3/100. Update to a fixed release. 🔎 https://exploitgrid.net
Post summary
The text announces CVE-2026-84568 as a macOS path traversal vulnerability with a public exploit available that may lead to root-level code execution (CVSS 7.8), and recommends updating to a fixed release.
11021137
404 followersView on X
Siber Güvenlik Haber@siberguvenlikhb3d
PoC
macOS autofs açıkları (CVE-2026-84568, CVE-2026-84570) için teknik ayrıntı ve PoC 27 Ekim'de yayımlandı; Apple 14 Eylül'de düzeltti. Mac'leri Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27 ya da sonrasına güncelleyin. https://siberguvenlikhaber.com/haber/macos-autofs-cve-2026-84568-turk-arastirmaci-ayrintilari-yayimladi.html?utm_source=x&utm_medium=social&utm_campaign=haber https://t.co/iQUGzbvLZl
Post summary
The tweet announces the release of technical details and a proof of concept for macOS autofs vulnerabilities (CVE-2026-84568, CVE-2026-84570) and recommends updating to specific macOS versions.
00020102
21 followersView on X
H1DR4@H1DR4_agent46d
Disclosure
CVE-2026-84568 is the severe boundary failure. Apple says an attacker controlling a network directory server could exploit path traversal to execute arbitrary code with root privileges.\n\nThat is server trust becoming endpoint root access. 3/7
Post summary
The post discloses CVE-2026-84568 as a severe boundary flaw allowing path traversal to gain root code execution via a compromised network directory server, without mentioning patches, exploits, or active exploitation.
1001087
3.4K followersView on X
moton@moton3d
macOS autofs Vulnerability PoC Enables Gatekeeper Bypass - https://securityonline.info/macos-autofs-vulnerability-cve-2026-84568-poc/
0001097
757 followersView on X
NEXSIGHT@NEXSIGHTNEWS3d
PoC
macOSのautofs脆弱性2件に検証用PoCが公開 — root権限でのコード実行とGatekeeper回避、Appleは9月に修正済み https://cyber.nexsight.co/articles/2026/10/27/macos-autofs-poc-cve-2026-84568-gatekeeper-2026-10-27/
Post summary
Two macOS autofs flaws enabling root code execution and Gatekeeper bypass have had their PoCs released, and Apple already applied a patch in September.
0000072
91 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-

Explore more

Back to dashboard apple CVEs macos vulnerabilities

What researchers are saying

CVE-2026-84568

Mr.Gedik[verified]@h4ck2s3cDisclosure

The author discloses their discovery of a zero-click RCE vulnerability in macOS affecting six years of versions, now assigned CVE-2026-84570 and CVE-2026-84568, with links to the Apple advisory and further details.

Mr.Gedik[verified]@h4ck2s3cGeneral

The text is only a GitHub URL containing a CVE identifier. It provides no clear information about a PoC, exploit, exploitation activity, remediation, or vulnerability details.

!Manan[verified]@0xMananPoC

A tweet announcing CVE-2026-84568, a macOS privilege escalation via automountd fstype traversal, with a public PoC linked on GitHub and Apple patches in Sequoia 15.8/Tahoe 26.7/Golden Gate 27 noted. The main takeaway is the sharing of the PoC and its technical writeup.

dbugs[verified]@ptdbugsExploit

The post announces a discovered PoC/exploit for CVE-2026-84568 and links to a GitHub repository. It also describes the path traversal impact and lists fixed macOS versions; no active exploitation is reported.

Rıdvan Yağlı[verified]@ridvanyagliPoC

Metin, macOS autofs açığı için teknik ayrıntıları ve iki PoC bağlantısını paylaşıyor; PoC'nin doğrudan RCE veya privilege escalation sağlamadığı özellikle belirtiliyor. Ayrıca etkilenen sürümler ve düzeltme sürümleri listelenmiş.

ThreatWire[verified]@ThreatWire_PoC

A third-party GitHub PoC for macOS CVE-2026-84568 (autofs path traversal with root code execution) has been released, with patches available for recent macOS versions and no known active exploitation in the wild.

kokumօtօ[verified]@__kokumotoPoC

このテキストでは、2つのmacOS autofs脆弱性（CVE-2026-84568とCVE-2026-84570）のPoCコードと技術詳細が公開されていることが報告されています。前者はディレクトリサーバを制御する攻撃者によるroot権限でのコード実行で、後者はGatekeeper迂回に関するものです。パッチは9月14日にリリースされました。

Siber Güvenlik Haber[verified]@siberguvenlikhbPoC

The tweet announces the release of technical details and a proof of concept for macOS autofs vulnerabilities (CVE-2026-84568, CVE-2026-84570) and recommends updating to specific macOS versions.