CVE-2026-43790: Critical macOS Kernel Memory Corruption — Detection, Patching, and Remediation Guide

Apple has released emergency security updates addressing CVE-2026-43790, a CVSS 9.1 (Critical) vulnerability in macOS that is remotely exploitable over the network. Per the NVD entry and Apple's advisory language, the flaw was addressed with "improved memory handling" — a phrase Apple consistently uses for memory corruption issues, and in this case the impact statement is explicit: a remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

Let me be blunt about what that means for defenders. Kernel memory corruption from a network-reachable code path is the class of vulnerability that underpins full device compromise chains. Even when the immediate observed impact is a denial of service (kernel panic), memory corruption primitives of this type are frequently the foundation for arbitrary kernel code execution once exploitation matures. A CVSS 9.1 network vector with no authentication requirement is not something you queue for next month's patch cycle — this belongs in your expedited change window this week.

The affected platforms span nearly the entire modern macOS fleet: macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain the fixes, meaning every prior release of those operating system trains is exposed. If your organization runs Macs — executive laptops, developer workstations, build servers, creative teams — they are in scope.

Technical Analysis

Affected Products and Fixed Versions

Any macOS version not listed above (older, unsupported trains) should be assumed vulnerable and unpatchable — treat those hosts as requiring isolation or upgrade.

Vulnerability Mechanics (Defender's View)

Apple's description — "improved memory handling" fixing a condition where a remote attacker can "cause unexpected system termination or corrupt kernel memory" — tells us several things:

1. Attack surface is network-reachable. The vulnerable code path parses or processes data arriving over the network without requiring local user interaction. Candidate surfaces on macOS historically include mDNSResponder/Bonjour, AirDrop, the SMB/AFP client-server stack, and network extension handling — Apple has not named the specific component, so defenders should assume any listening service could be the vector.
2. The corruption reaches kernel space. This is not a sandboxed userland crash. Kernel memory corruption means the attacker influences ring-0 state. The best-case outcome is a kernel panic (DoS); the worst-case is a stepping stone to kernel code execution.
3. No user interaction is required. "Remote attacker may be able to" with a NETWORK attack vector implies unauthenticated, zero-click reachability — the most dangerous exploitation class on an endpoint OS.

Exploitation Status

As of publication, there is no confirmed public proof-of-concept and CVE-2026-43790 is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Apple's advisory language does not include the "aware of a report that this issue may have been actively exploited" statement it uses for in-the-wild zero-days. That said, do not let the absence of confirmed exploitation breed complacency: kernel memory corruption bugs with network reachability are exactly what mature exploit developers and nation-state actors weaponize quietly. Patch as if exploitation is imminent.

Why Kernel Panics Matter to Your SOC

Even in the DoS-only scenario, this vulnerability is operationally significant. A remote, unauthenticated kernel panic primitive against macOS endpoints can be used to:

• Blind security tooling during a lateral movement window (crash the sensor host, move while EDR restarts).
• Disrupt developer build infrastructure and CI runners.
• Create incident-response noise that masks a parallel intrusion.

Fleet-wide unexplained kernel panics correlating in time are a detection signal in their own right — treat them as potential exploitation attempts, not hardware faults.

Detection & Response

Detection of the underlying memory corruption itself is not feasible at the signature level without PoC details. The defensible detection strategy is behavioral: (1) hunt for kernel panics and unexpected system terminations across the Mac fleet, (2) watch for anomalous inbound network connections to macOS hosts from unexpected sources, and (3) inventory unpatched macOS versions as a continuous exposure metric.

Sigma Rules

---
title: macOS Kernel Panic - Potential CVE-2026-43790 Exploitation Attempt
id: 3f8a2c41-7b9d-4e52-a6c1-9d0e5f2a8b34
status: experimental
description: Detects kernel panic events on macOS endpoints. In the context of CVE-2026-43790, a remote network-exploitable kernel memory corruption flaw, unexpected kernel panics may indicate exploitation attempts causing system termination.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-43790
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: macos
  service: system
detection:
  selection:
    EventMessage|contains:
      - 'kernel panic'
      - 'panic(cpu'
      - 'Unexpected SoC (system) watchdog'
      - 'BSD process name corresponding to current thread'
  condition: selection
falsepositives:
  - Genuine hardware faults, driver instability, or beta OS builds. Correlate frequency - repeated panics across multiple hosts in a short window are the high-fidelity signal.
level: medium
---
title: Suspicious Inbound Network Connection to macOS Listening Service
id: 8c1d5e72-4a3f-4b68-9d27-5e0a6c3f1942
status: experimental
description: Detects inbound network connections to common macOS network-facing services from external or non-standard sources. CVE-2026-43790 is remotely exploitable via the network, so anomalous inbound traffic to macOS daemons is a relevant hunt hypothesis.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-43790
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: macos
  category: network_connection
detection:
  selection:
    Image|contains:
      - '/usr/sbin/mDNSResponder'
      - '/usr/libexec/sharingd'
      - '/usr/sbin/smbd'
      - '/usr/sbin/AppleFileServer'
      - '/usr/libexec/remoted'
    Initiated: 'false'
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_local
falsepositives:
  - Corporate VPN routings, MDM vendor callbacks, and internet-facing build servers. Tune per-network baseline; the rule is most valuable on end-user workstations that should never receive unsolicited inbound internet traffic.
level: medium

KQL — Microsoft Sentinel / Defender

If your Mac fleet is enrolled in Microsoft Defender for Endpoint (recommended for exactly this scenario), process and network telemetry flows into DeviceNetworkEvents and DeviceProcessEvents. macOS system logs ingested via Syslog/CEF collectors can be hunted in Syslog.

// Hunt 1: Kernel panics and unexpected terminations on macOS hosts via Syslog ingestion
// Correlate with fleet-wide timing to distinguish CVE-2026-43790 exploitation from hardware faults
Syslog
| where TimeGenerated > ago(7d)
| where Computer has_any ("mac", "MacBook", "Mac-Pro", "Mac-mini")  // tune to your naming convention
| where SyslogMessage has_any ("kernel panic", "panic(cpu", "watchdog timeout", "unexpected system termination")
| summarize PanicCount = count(), DistinctHosts = dcount(Computer), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, bin(TimeGenerated, 1h)
| where DistinctHosts >= 1
| sort by TimeGenerated desc;

// Hunt 2: Anomalous inbound connections to macOS network-facing daemons (MDE-enrolled Macs)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("mac", "MacBook")  // tune to your naming convention
| where InitiatingProcessFileName in~ ("mDNSResponder", "sharingd", "smbd", "remoted", "rapportd")
| where RemoteIPType == "Public" or (RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16.")
| summarize ConnectionCount = count(), UniqueRemoteIPs = dcount(RemoteIP), RemoteIPList = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| sort by ConnectionCount desc;

// Hunt 3: Exposure inventory - macOS hosts running vulnerable OS versions
DeviceInfo
| where OSPlatform =~ "macOS"
| summarize arg_max(TimeGenerated, *) by DeviceId
| extend OSVersionParts = split(OSVersion, ".")
| where not (OSVersion startswith "27" or (OSVersion startswith "15." and toint(OSVersionParts[1]) >= 8) or (OSVersion startswith "26." and toint(OSVersionParts[1]) >= 7))
| project DeviceName, OSVersion, OSPlatform, LastSeen = TimeGenerated
| sort by OSVersion asc;

Velociraptor VQL

For DFIR teams running Velociraptor against macOS endpoints (via the macOS client), this artifact hunts for recent panic logs — the primary on-host forensic artifact of a CVE-2026-43790 exploitation attempt:

-- Hunt for macOS kernel panic logs indicating potential exploitation of remote kernel memory corruption (CVE-2026-43790)
-- Panic logs persist in /Library/Logs/DiagnosticReports (*.panic files)
LET panic_files = SELECT FullPath, Mtime, Size
FROM glob(globs='/Library/Logs/DiagnosticReports/*.panic')
WHERE Mtime > timestamp(epoch=now() - 604800)

SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=4096) AS PanicHeader
FROM panic_files
ORDER BY Mtime DESC

A companion artifact for network state at time of triage:

-- Snapshot listening services and established connections on macOS endpoints
-- Look for unexpected listeners or established sessions from untrusted external IPs
SELECT Pid, Name, Path, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE State =~ 'LISTEN|ESTABLISHED'
  AND NOT RemoteAddr =~ '^(127\.|::1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)'
ORDER BY Name ASC

Remediation & Verification Script

Use this Bash script via your MDM (Jamf, Kandji, Intune) or manually on endpoints to report current OS version, check whether the host is on a fixed build, and trigger available updates:

#!/bin/bash
# CVE-2026-43790 - macOS kernel memory corruption patch verification
# Run via MDM as root or locally with sudo

echo "=== CVE-2026-43790 macOS Patch Verification ==="

# Gather current OS version and build
OS_VERSION=$(/usr/bin/sw_vers -productVersion)
OS_BUILD=$(/usr/bin/sw_vers -buildVersion)
echo "Current macOS Version: $OS_VERSION (Build $OS_BUILD)"

# Parse major/minor for fixed-version comparison
MAJOR=$(echo "$OS_VERSION" | cut -d. -f1)
MINOR=$(echo "$OS_VERSION" | cut -d. -f2)

PATCHED="false"
if [ "$MAJOR" -ge 27 ] 2>/dev/null; then
    PATCHED="true"
elif [ "$MAJOR" -eq 26 ] && [ "$MINOR" -ge 7 ] 2>/dev/null; then
    PATCHED="true"
elif [ "$MAJOR" -eq 15 ] && [ "$MINOR" -ge 8 ] 2>/dev/null; then
    PATCHED="true"
fi

if [ "$PATCHED" = "true" ]; then
    echo "[PASS] Host is on a fixed release for CVE-2026-43790."
    exit 0
else
    echo "[FAIL] Host is VULNERABLE - below fixed version (Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7)."
fi

# Check for pending Apple updates
sfecho "--- Checking for available software updates ---"
/usr/sbin/softwareupdate -l 2>&1

# Optionally force update installation (uncomment for enforced remediation via MDM):
# /usr/sbin/softwareupdate -i -a --restart

# Report recent kernel panics as potential exploitation indicators
echo "--- Recent panic logs (last 7 days) ---"
/usr/bin/find /Library/Logs/DiagnosticReports -name "*.panic" -mtime -7 -exec ls -la {} \; 2>/dev/null || echo "No recent panic logs found."

exit 1

Remediation

Immediate actions (this week):

1. Patch all macOS hosts to the fixed releases: macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7. Deploy via MDM enforced update deadlines — Apple's Declarative Device Management OS update enforcement or softwareupdate -i -a --restart. Do not rely on user-driven updates for a CVSS 9.1.
2. Verify the NVD entry and Apple advisory: Reference the NVD entry for CVE-2026-43790 and Apple's security releases page (support.apple.com/en-us/HT201222) for the authoritative fixed-version list per OS train.
3. Inventory unsupported macOS versions. Any host on a train older than Sequoia 15.x has no fix path — escalate for OS upgrade or isolate from network exposure immediately.

Interim risk reduction (where patching is delayed):

• Reduce the network attack surface: Disable unnecessary sharing services (System Settings → General → Sharing): File Sharing, Screen Sharing, Remote Login, AirDrop receiving (set to Contacts Only or off) on hosts that don't need them.
• Enable the Application Firewall and, where feasible, deploy a host-based firewall policy restricting unsolicited inbound connections to macOS endpoints.
• Segment Mac fleets. End-user workstations should not be reachable from arbitrary VLANs or guest networks; internet-facing macOS services should be near zero — audit and eliminate exceptions.
• Monitor for exploitation indicators: fleet-correlated kernel panics, anomalous inbound connections to system daemons, and unexpected host reboots. Escalate any cluster of panics to IR for memory-acquisition triage before the evidence window closes.

Post-patch validation:

• Re-run your vulnerability scanner against the Mac fleet and confirm fixed builds are reported.
• Confirm MDM update compliance reporting shows 100% of in-scope hosts at or above the fixed versions.
• Watch the CISA KEV catalog — if CVE-2026-43790 is added, federal remediation deadlines (typically 2-3 weeks for BOD 22-01 bound agencies) become mandatory, and your prioritization should escalate accordingly.

Kernel memory corruption with a network vector is the vulnerability class that keeps endpoint defense honest. The patch exists, the fix is free, and the exploitation barrier for motivated actors only drops with time. Close this one fast.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub