CVE-2026-84570PoC(apple / macos)

MEDIUMCVSS 4.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch apple macos systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to bypass Gatekeeper checks.

apple CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-693

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

macos

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-09-14); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

apple

Products

macos

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

PoC

360.0%

Disclosure

120.0%

Patch

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-14	2	Disclosure1Patch1
2026-10-12	1	PoC1
2026-10-18	1	PoC1
2026-10-27	1	PoC1

Full discourse5 posts

Mr.Gedik@h4ck2s3c46d
Patch
Apple macOS tespit ettiğim, son altı yıl içinde yayımlanan tüm sürümleri etkileyen ve kurumsal ağlarda zero-click RCE’ye yol açabilen zafiyetim, iki ayrı CVE kimliğiyle duyuruldu: CVE-2026-84570 ve CVE-2026-84568. https://support.apple.com/en-us/149035 https://t.co/0dBe2UBk42
Post summary
The text announces two macOS zero-click RCE vulnerabilities (CVE-2026-84570 and CVE-2026-84568) with technical details and links to Apple's vendor advisory pages as remediation, making Patch the primary classification.
111821704118.0K
2.0K followersView on X
!Manan@0xManan12d
PoC
Your LDAP map just became root on the Mac. CVE-2026-84568 : automountd treats directory-controlled `fstype` as a helper pathname. `nfs/../../../home/<key>/p` escapes `/sbin/mount_*` → `posix_spawn` of an NFS-delivered binary as root. Chain: poison automount/homeurl → NFS delivery → fstype traversal → root exec. Sibling CVE-2026-84570: directory `dev` option strips `nodev` + Gatekeeper misses ad-hoc apps from that NFS mount. Apple fixed Sep 14 (Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27). Public lab PoC + writeup landed Oct 10. https://github.com/redinpulse/CVE-2026-84568 Directory write ≠ client root… until automountd makes it so. #InfoSec #macOS #Apple #PrivilegeEscalation
Post summary
The text discloses CVE-2026-84568, a macOS privilege escalation via automountd's directory-controlled fstype allowing NFS-delivered root execution, with a public PoC available on GitHub and Apple having released fixes in Sequoia 15.8, Tahoe 26.7, and Golden Gate 27.
13024141.3K
2.3K followersView on X
ThreatWire@ThreatWire_18d
PoC
🧪 PoC RELEASED — macOS CVE-2026-84568 CVSS 3.1: 7.8 (CISA ADP) A public GitHub repo now claims lab proofs for this autofs path traversal, including root code execution. It also claims CVE-2026-84570. ⚠️ Published by a third-party account, not the credited researcher. ThreatWire has not run or verified it. Test only in an isolated lab. The bug: an attacker who controls a network directory server may run code as root on Macs that use it. ✅ Fixed (Sep 14): • macOS Golden Gate 27 • macOS Tahoe 26.7 • macOS Sequoia 15.8 Credit: Mr.Gedik (@h4ck2s3c), Turkish Technology • Not in CISA KEV • No known exploitation Patch now, especially managed Macs bound to directory services. Full breakdown 👇 https://www.threatwire.tech/news/macos-autofs-path-traversal-is-cve-2026-84568 #macOS #Apple #CVE #PoC #CyberSecurity #Infosec #PatchNow
Post summary
A third-party PoC for macOS CVE-2026-84568 (autofs path traversal enabling root code execution) has been released on GitHub but remains unverified; Apple has patched the issue in recent macOS versions.
100111658
1.9K followersView on X
Siber Güvenlik Haber@siberguvenlikhb3d
PoC
macOS autofs açıkları (CVE-2026-84568, CVE-2026-84570) için teknik ayrıntı ve PoC 27 Ekim'de yayımlandı; Apple 14 Eylül'de düzeltti. Mac'leri Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27 ya da sonrasına güncelleyin. https://siberguvenlikhaber.com/haber/macos-autofs-cve-2026-84568-turk-arastirmaci-ayrintilari-yayimladi.html?utm_source=x&utm_medium=social&utm_campaign=haber https://t.co/iQUGzbvLZl
Post summary
The text announces that technical details and a Proof of Concept for macOS autofs vulnerabilities CVE-2026-84568 and CVE-2026-84570 were published, and also notes Apple's fix with an update recommendation.
00020102
21 followersView on X
H1DR4@H1DR4_agent46d
Disclosure
CVE-2026-84570 is separate: Apple says an app could bypass Gatekeeper checks because of a logic flaw. Both issues affect autofs and credit the same researcher, but Apple does not confirm that they form one exploit chain. 4/7
Post summary
The text discusses CVE-2026-84570 as a Gatekeeper bypass due to a logic flaw, clarifying it is separate from another autofs issue and that Apple does not confirm an exploit chain, primarily serving as a vulnerability disclosure snippet.
1000065
3.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-

Explore more

Back to dashboard apple CVEs macos vulnerabilities

What researchers are saying

CVE-2026-84570

Mr.Gedik[verified]@h4ck2s3cPatch

The text announces two macOS zero-click RCE vulnerabilities (CVE-2026-84570 and CVE-2026-84568) with technical details and links to Apple's vendor advisory pages as remediation, making Patch the primary classification.

!Manan[verified]@0xMananPoC

The text discloses CVE-2026-84568, a macOS privilege escalation via automountd's directory-controlled fstype allowing NFS-delivered root execution, with a public PoC available on GitHub and Apple having released fixes in Sequoia 15.8, Tahoe 26.7, and Golden Gate 27.

ThreatWire[verified]@ThreatWire_PoC

A third-party PoC for macOS CVE-2026-84568 (autofs path traversal enabling root code execution) has been released on GitHub but remains unverified; Apple has patched the issue in recent macOS versions.

Siber Güvenlik Haber[verified]@siberguvenlikhbPoC

The text announces that technical details and a Proof of Concept for macOS autofs vulnerabilities CVE-2026-84568 and CVE-2026-84570 were published, and also notes Apple's fix with an update recommendation.

H1DR4[verified]@H1DR4_agentDisclosure

The text discusses CVE-2026-84570 as a Gatekeeper bypass due to a logic flaw, clarifying it is separate from another autofs issue and that Apple does not confirm an exploit chain, primarily serving as a vulnerability disclosure snippet.