CVE-2026-65400 macOS Flaw Added to CISA KEV, Actively Exploited

Executive Summary

CISA added CVE-2026-65400, a critical improper authentication vulnerability in Apple macOS, to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026, confirming active exploitation in the wild. The flaw carries a CVSS score of 9.8, making it one of the most severe macOS issues tracked this year. Defenders should treat any macOS device as potentially compromised if exposed to untrusted networks, as no patch is currently available.

The vulnerability allows an unauthenticated attacker to bypass macOS authentication mechanisms, potentially gaining full system access. CISA's KEV listing is the authoritative confirmation of exploitation, but the agency did not disclose the attack vector, affected macOS versions, or the identity of the threat actors. Apple has not yet released a security update addressing this flaw, leaving enterprise fleets in a precarious position.

Technical Analysis

CVE-2026-65400 is classified as an improper authentication vulnerability (CWE-287) in Apple macOS. The CVSS 9.8 score reflects the lack of required privileges, the absence of user interaction, and the potential for complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the authentication stack, though the specific component—whether it affects the login window, Keychain, or a system daemon—has not been publicly detailed.

CISA added this CVE to the KEV catalog on Tuesday, August 18, 2026, alongside three other flaws affecting SharePoint, vCenter, and Microsoft IKE. The KEV designation means federal civilian executive branch (FCEB) agencies must remediate the vulnerability by a mandated deadline, but it also signals to the broader security community that exploitation is confirmed and ongoing.

The lack of a patch is the most pressing concern. Apple's typical response timeline for KEV-listed vulnerabilities has varied from days to weeks. Until an update ships, the only mitigation is to reduce attack surface. The authentication bypass nature of the flaw suggests that network-level exposure is the primary risk—macOS systems reachable from untrusted networks, such as those used in remote work or exposed services, are the most likely targets.

No public exploit code has been released, and CISA's advisory does not include indicators of compromise (IOCs) or attribution. The absence of technical details suggests the exploitation may be targeted, possibly by a nation-state actor, though this remains speculative. The other three CVEs added to KEV on the same date—affecting SharePoint, vCenter, and Microsoft IKE—indicate a coordinated exploitation campaign or a batch disclosure from a single research group, but no evidence links them to the same threat actor.

Mitigations & Recommendations

Until Apple releases a patch, defenders should assume that any macOS system exposed to untrusted networks is at risk. The following steps are recommended based on the confirmed exploitation status:

• Isolate affected systems: Place macOS devices on segmented network segments, blocking inbound connections from the internet and untrusted LANs. If remote access is required, enforce VPN-only connectivity with strong multi-factor authentication.
• Monitor authentication logs: Watch for unusual login patterns, especially successful logins from unexpected IP addresses or at abnormal times. macOS unified logs (log show --predicate 'process == "loginwindow"') can reveal authentication anomalies.
• Restrict administrative privileges: Limit local admin accounts and enforce standard user accounts where possible. The authentication bypass may grant root-level access, so reducing the number of privileged accounts limits lateral movement.
• Apply compensating controls: Deploy endpoint detection and response (EDR) agents on macOS endpoints to detect post-exploitation behavior, such as persistence mechanisms or unauthorized process execution.
• Watch for Apple's security update: Monitor Apple's security releases page and apply the patch immediately upon availability. Verify the update addresses CVE-2026-65400 before deployment.
• Check CISA KEV catalog regularly: The KEV list is updated frequently; ensure your vulnerability management process ingests new entries and triggers alerts for affected products.

Defenders should not wait for exploit code to appear publicly. The KEV designation confirms real-world use, and the 9.8 CVSS score indicates the impact is severe. Prioritize this issue above other macOS vulnerabilities that are not yet confirmed as exploited.