Apple macOS Auth Bug Exposed by CISA Adds Four Critical Flaws

On Tuesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced it had added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog, stating they are being exploited in the wild ¹.

The most prominent of these is CVE‑2026‑65400, an improper authentication vulnerability impacting Apple’s macOS that could allow an unauthenticated actor to gain elevated privileges through session hijacking if they can predict or guess user sessions. With a CVSS score of 9.8, the bug represents one of the highest severity risks currently affecting macOS users ¹.

In addition to CVE‑2026‑65400, CISA listed three other critical vulnerabilities—though their specific identifiers were not disclosed—in the KEV catalog. All four have been confirmed as “actively exploited” by threat actors who target both individual devices and enterprise environments running outdated macOS versions. The agency urged all affected parties to apply available patches immediately and to monitor for anomalous authentication attempts ¹.

The improper authentication flaw in macOS mirrors similar weaknesses found in Microsoft IKE protocols and SharePoint services, showing how session management remains a common attack vector.

Patch deployment is crucial because many organizations still run legacy macOS versions that are no longer supported or patched. Even with official updates released, user behavior often lags: some administrators delay upgrades due to compatibility concerns or lack awareness of the vulnerability’s severity. Experts recommend immediate patching, coupled with enforcing multi‑factor authentication where possible, to mitigate the risk of unauthorized elevation and potential data exfiltration ¹.

The CISA announcement serves as a stark reminder that even widely used operating systems can harbor critical flaws until they’re discovered and remediated. For end users, keeping software up to date and monitoring login activity remain the most effective defenses against these kinds of exploitation attempts.