Multiple security vulnerabilities have been identified in macOS autofs, the component that mounts network filesystems from directory services. The flaws affect systems that use directory-controlled automounting and can allow privileged code execution or security-control bypass when an attacker can influence directory data. The affected releases are those using the vulnerable automount behavior in directory-bound deployments. This creates a broad attack surface for organizations that bind client machines to shared directory services.
CVE-2026-84568 (CVSS 7.8 — High): A path-handling flaw in the automount process lets a crafted directory-supplied filesystem type escape the expected helper location and cause a privileged process to launch an attacker-controlled binary. An attacker who can write to the directory and trigger a lookup can achieve code execution, with root execution when the lookup originates from a privileged context.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in macOS autofs, the component that mounts network filesystems from directory services. The flaws affect systems that use directory-controlled automounting and can allow privileged code execution or security-control bypass when an attacker can influence directory data. The affected releases are those using the vulnerable automount behavior in directory-bound deployments. This creates a broad attack surface for organizations that bind client machines to shared directory services.
CVE-2026-84568 (CVSS 7.8 — High): A path-handling flaw in the automount process lets a crafted directory-supplied filesystem type escape the expected helper location and cause a privileged process to launch an attacker-controlled binary. An attacker who can write to the directory and trigger a lookup can achieve code execution, with root execution when the lookup originates from a privileged context.[emaillocker id="1283"]
CVE-2026-84570 (CVSS 4.4 — Medium): A flaw in how automount options are processed allows directory-supplied options to remove default protections from a network mount, including restrictions that normally prevent execution and quarantine handling. This can let an attacker bypass application approval controls and run untrusted software from the mounted filesystem.
These vulnerabilities collectively present a serious risk to macOS systems that rely on directory-controlled network mounts, especially enterprise environments where many machines share the same directory data. The most exposed systems are those that allow untrusted or insufficiently controlled directory entries to influence automount behavior. Prompt attention to reduce exposure to attacker-controlled directory data is warranted.
We recommend you to update Apple macOS to version 15.8, 26.7, or 27 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]