CVE-2026-65381: Critical macOS Sandbox Escape (CVSS 10) — Detection and Remediation Guide

Apple has patched a maximum-severity vulnerability in macOS tracked as CVE-2026-65381. The flaw is a validation weakness in the operating system's entitlement verification logic, and the practical consequence is severe: a malicious application may be able to break out of its sandbox. With a CVSS score of 10.0 and a network-exploitable pathway, this is the kind of vulnerability that collapses one of the core security assumptions macOS administrators rely on — that a compromised or malicious App Store / notarized app is contained.

The sandbox is not a courtesy control. It is the barrier that keeps a trojanized productivity app, a malicious package delivered via a watering-hole download, or a compromised dependency from touching user keychains, browser sessions, TCC-protected data (Documents, Desktop, camera, microphone), and other applications' containers. When that barrier fails, a single malicious app execution becomes a full user-context compromise — and, with follow-on privilege escalation, a host compromise.

If your fleet includes macOS endpoints — developer workstations, executive laptops, creative teams — treat this as an emergency patch event.

Affected Products and Fixed Versions

Per the vendor advisory reflected in the NVD entry, the issue is addressed in:

• macOS Golden Gate 27
• macOS Sequoia 15.8
• macOS Tahoe 26.7

Any macOS system running a build earlier than these fixed versions should be considered vulnerable. The cross-branch fix (three separate OS trains patched simultaneously) tells us the vulnerable code path is shared across current supported releases — this is not an edge-case bug in a legacy branch.

Key details:

Technical Analysis: Entitlement Validation and Why It Matters

The Mechanism (Defender's View)

macOS entitlements are key-value declarations embedded in a binary's code signature that govern what a process is permitted to do — access specific app groups, use hardened-runtime exceptions, interact with XPC services, or opt out of sandbox restrictions. The sandbox daemon (sandboxd, backed by the Sandbox kernel extension and Seatbelt profiles) consults these entitlements when deciding whether to permit a requested operation.

The vulnerability, as described, is a validation flaw in the entitlement verification path: the operating system fails to properly validate a process's claimed entitlement before honoring it. In practical terms, a malicious app can present itself in a way that causes the OS to grant capabilities it should not possess — and Apple's own impact statement confirms the outcome: breaking out of the sandbox.

Why the Network Vector Scores a 10

A CVSS 10 with a network pathway for a sandbox escape typically reflects one of two realities: either the entitlement check is exercised during handling of remotely supplied content (e.g., an app processing attacker-controlled data from the network reaches the vulnerable validation path), or exploit delivery is trivially remote (drive-by download, malicious package, MDM-pushed or sideloaded app). Either way, the barrier to exploitation is low: the attacker needs their code to execute as an app on the target — delivery via phishing, malicious update channels, or supply-chain insertion covers that requirement.

Exploitation Requirements and Chain

1. Delivery: Attacker gets a malicious application onto the target (phishing, trojanized software, malicious DMG/pkg, compromised developer toolchain).
2. Execution: User or automated process launches the app — it runs inside its sandboxed container, appearing benign.
3. Exploitation: The app exercises the entitlement validation flaw, causing the OS to honor an entitlement it should reject.
4. Escape: The process operates outside its sandbox profile — unrestricted filesystem access within user context, access to other apps' data, TCC-protected resources, keychain items scoped to other apps, and the ability to persist via LaunchAgents.

Exploitation Status

As of this writing, the NVD entry describes the flaw and fix; Apple advisories typically do not detail exploitation mechanics. There is no confirmed public in-the-wild exploitation or CISA KEV listing reported in the source item — but do not let that dictate your tempo. Sandbox escapes with CVSS 10 scores are precisely the class of vulnerability that gets weaponized quickly once patches ship and diffing begins. The patch itself is a blueprint. Assume the exploitation clock started the day the fix shipped.

Detection & Response

Candidly: there is no signature for the entitlement-validation bypass itself — it happens inside OS trust-decision logic and produces no clean, high-fidelity telemetry artifact at the point of exploitation. What defenders can detect is the post-escape behavioral fallout: a process that should be sandboxed behaving like an unsandboxed process. These are the detections worth deploying, tuned to reduce noise in fleets with heavy developer tooling.

Sigma Rules

---
title: Sandboxed macOS App Spawning Shell or Interpreter Outside Container
id: 3f9c1a72-6b48-4e2d-9a51-7c4e8b2f9012
status: experimental
description: Detects applications installed under /Applications spawning shells or script interpreters with working paths outside their sandbox container, consistent with post-sandbox-escape behavior such as that enabled by CVE-2026-65381.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65381
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|startswith: '/Applications/'
  selection_child:
    Image|endswith:
      - '/zsh'
      - '/bash'
      - '/sh'
      - '/python'
      - '/python3'
      - '/osascript'
      - '/ruby'
      - '/perl'
      - '/curl'
  filter_known_dev_tools:
    ParentImage|contains:
      - '/Xcode.app/'
      - '/Terminal.app/'
      - '/iTerm'
      - '/Visual Studio Code'
      - '/JetBrains'
  condition: selection_parent and selection_child and not filter_known_dev_tools
falsepositives:
  - Legitimate applications that invoke helper shells (backup tools, installers); tune by parent process hash
level: high
---
title: macOS Persistence via LaunchAgent from Application-Context Process
id: 8d2e5b14-3a6f-4c19-b874-9f1d6a3e2075
status: experimental
description: Detects write activity to LaunchAgents/LaunchDaemons directories by processes whose parent is an installed application rather than an installer or MDM agent — a common post-sandbox-escape persistence move after exploitation of flaws such as CVE-2026-65381.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65381
  - https://attack.mitre.org/techniques/T1543/001/
author: Security Arsenal
date: 2026/02/12
tags:
  - attack.persistence
  - attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
      - '/LaunchAgents/'
  selection_ext:
    TargetFilename|endswith: '.plist'
  filter_installers:
    Image|endswith:
      - '/installer'
      - '/packagekitd'
      - '/softwareupdated'
      - '/mdmclient'
  condition: selection_path and selection_ext and not filter_installers
falsepositives:
  - Legitimate software updaters and enterprise agents installing helpers; baseline by signer/team ID
level: medium

KQL — Microsoft Defender for Endpoint on macOS / Sentinel

MDE supports macOS and surfaces DeviceProcessEvents and DeviceFileEvents for Apple endpoints, which makes this hunt viable in Sentinel even for a Mac-only threat. The query below hunts the post-escape pattern: sandboxed-looking app parents spawning interactive tooling or writing persistence.

// Hunt: macOS apps spawning shells/interpreters or writing LaunchAgents — post-sandbox-escape behavior (CVE-2026-65381)
let SuspiciousChildren = dynamic(["zsh","bash","sh","python","python3","osascript","curl","wget","launchctl","plutil"]
);
let DevToolParents = dynamic(["Xcode","Terminal","iTerm","Code Helper","JetBrains","idea","webstorm"]
);
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName !has_any (DevToolParents)
    | where InitiatingProcessFolderPath startswith "/Applications/"
    | where FileName has_any (SuspiciousChildren)
    | project TimeGenerated, DeviceName, InitiatingProcessFolderPath, InitiatingProcessCommandLine,
              FileName, ProcessCommandLine, AccountName, ReportId;
let PersistenceHits =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any ("/Library/LaunchAgents/", "/Library/LaunchDaemons/", "/LaunchAgents/")
    | where FileName endswith ".plist"
    | where ActionType in ("FileCreated", "FileModified")
    | where InitiatingProcessFileName !in~ ("installer", "softwareupdated", "mdmclient", "packagekitd")
    | project TimeGenerated, DeviceName, FolderPath, FileName,
              InitiatingProcessFolderPath, InitiatingProcessCommandLine, AccountName, ReportId;
union ProcHits, PersistenceHits
| sort by TimeGenerated desc

Velociraptor VQL — macOS Endpoint Hunt

Velociraptor runs on macOS and can pull live process lineage plus LaunchAgent persistence artifacts across the fleet in one artifact. This hunt looks for processes executing from user-writable or temp locations (a sandbox escapee often drops and runs payloads outside its container) alongside recently modified LaunchAgent plists.

-- macOS hunt: processes running from user-writable/temp paths + recent LaunchAgent persistence
-- Targets post-exploitation behavior consistent with a sandbox escape (CVE-2026-65381)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(/tmp/|/private/tmp/|/var/folders/|/Users/[^/]+/Downloads/|/Users/[^/]+/Library/(?!Containers))'
   OR CommandLine =~ '(?i)(osascript|curl .*(http|https)|base64 -d|launchctl load)'

-- Companion: LaunchAgent/LaunchDaemon plists modified in the last 7 days
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['/Library/LaunchAgents/*.plist',
                 '/Library/LaunchDaemons/*.plist',
                 '/Users/*/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

Remediation & Verification Script (Bash)

Run this via your MDM (Jamf, Kandji, Mosyle) or manually on endpoints to inventory the current macOS build, flag unpatched systems against the fixed baselines for CVE-2026-65381, and trigger pending updates. Deploy it as a compliance script so drift is caught continuously, not once.

#!/bin/bash
# CVE-2026-65381 — macOS sandbox escape patch verification
# Fixed baselines: Golden Gate 27.0, Sequoia 15.8, Tahoe 26.7

PRODUCT_VERSION=$(sw_vers -productVersion)
BUILD=$(sw_vers -buildVersion)
echo "[INFO] macOS ${PRODUCT_VERSION} (${BUILD})"

MAJOR=$(echo "$PRODUCT_VERSION" | cut -d. -f1)
MINOR=$(echo "$PRODUCT_VERSION" | cut -d. -f2)

PATCHED=false
case "$MAJOR" in
  27) PATCHED=true ;;                                   # Golden Gate 27+
  26) [ "$MINOR" -ge 7 ] && PATCHED=true ;;            # Tahoe 26.7+
  15) [ "$MINOR" -ge 8 ] && PATCHED=true ;;            # Sequoia 15.8+
  *)  PATCHED=false ;;                                  # Older trains: assume vulnerable/EOL
esac

if [ "$PATCHED" = true ]; then
  echo "[PASS] System meets the fixed baseline for CVE-2026-65381."
  exit 0
else
  echo "[FAIL] System is VULNERABLE to CVE-2026-65381 — update required."
  # List and trigger available macOS updates (requires proper entitlements/MDM context)
  softwareupdate --list
  softwareupdate --install --all --restart --agree-to-license
  exit 1
fi

# Optional hardening checks (informational):
# Confirm Gatekeeper and SIP are intact — defense-in-depth if a malicious app lands pre-patch
spctl --status
csrutil status

Remediation Guidance

1. Patch immediately. This is a CVSS 10. Push macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27 through your MDM with an enforced deadline. For MDM-managed fleets, use a declarative OS update command with a 48–72 hour enforcement window; do not rely on user-initiated updates.

2. Inventory by OS train. The fix spans three release trains — your fleet will be fragmented across them. Use your MDM or the script above to bucket devices by major version and confirm each lands on its respective patched minor. Devices on EOL macOS versions that received no fix should be treated as permanently vulnerable: upgrade or isolate them.

3. Reduce the attack surface in the interim. Until patching completes:

• Enforce allowlisting (Gatekeeper + MDM app restrictions) so only signed, approved applications execute.
• Restrict installation of apps from outside the App Store or your managed catalog.
• Verify SIP and Gatekeeper are enabled fleet-wide — they don't fix this bug, but they raise the cost of post-escape activity.

4. Hunt before and after patching. Deploy the detections above now. A sandbox escape may already have occurred on a machine that gets patched tomorrow — patching does not evict an established foothold. Retro-hunt LaunchAgent persistence and anomalous app-to-shell process lineage over the last 30 days on any host that was running unpatched builds.

5. Watch for follow-on advisories. Monitor the NVD entry and Apple's security releases page for updated exploitation details, and check whether CISA adds this to the Known Exploited Vulnerabilities catalog — a KEV listing would impose binding remediation deadlines for federal agencies and should tighten your own SLAs regardless of sector.

6. Treat developer and executive Macs as priority targets. Sandbox escapes are most valuable against high-context users — engineers with cloud credentials in ~/.aws, executives with sensitive documents. Sequence your rollout accordingly.

The bottom line: the sandbox is one of macOS's foundational containment controls, and CVE-2026-65381 breaks it with a network-reachable path and maximum severity. Patch on an emergency cadence, hunt for the behavioral fallout, and don't assume a patched endpoint is a clean endpoint.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub