Researcher: Apple patched TCC 0-day with no CVE or bounty
A researcher claims a universal method to bypass macOS protections, including TCC, and gain privileged access; he says the method is easily weaponized. He reports Apple confirmed the flaw 3 years ago, closed the report, and patched it in September with no CVE, credit, or bounty; the technical presentation was planned for OffensiveCon 2026 in Berlin. No real-world exploitation is reported in the sources; keeping macOS updated is the indicated measure.
What happened
A researcher claims a universal method to bypass several macOS protections, including TCC, the privacy permissions system, and gain privileged access. He says Apple confirmed the flaw 3 years ago, closed the report, and only patched it in September, with no CVE, credit, or bounty for the finder.
Why it matters
TCC governs privacy permissions on the Mac; a full bypass can expose sensitive user data to malicious programs. The researcher calls the method easily weaponized, which raises the risk for companies running Macs. With no CVE, security teams cannot track the fix through their usual tools.
What to do
Update every company Mac to the latest macOS version, since the fix was reportedly released in September. Watch OffensiveCon 2026 in Berlin, where technical details may be disclosed, and check with your EDR vendor for coverage of this type of bypass.
For the technical team
- Affected
- Apple macOS (TCC e demais proteções de segurança do sistema) · macOS; affected versions not specified in the source. According to the researcher, Apple promised the patch for macOS 27 in Fall 2026.
- Exploitation
- No exploitation reported in the sources and no technical details public so far. No CVE assigned, according to the researcher, who describes the method as easily weaponized.
- Fix
- According to the researcher, the vulnerability was patched in September with no CVE, credit, or bounty. The specific macOS version containing the fix was not cited in the source.
- Vector
- macOS; universal method that bypasses several system security protections, fully bypasses TCC (privacy permissions), and allows gaining other privileged access, according to the researcher. Specific component and exploitation conditions not described in the source.
- More details
- Single report from researcher @Guluisacat, in a post on X. Timeline as told by him: he planned to drop the 0-day at OffensiveCon 2026 in Berlin (planned 5 months earlier); submitted to Apple 3 years ago; Apple confirmed the vulnerability and closed the report; 2 years with no updates; after the talk was accepted, Apple asked him to hold off disclosure, promised a patch in macOS 27 (Fall 2026), and mentioned a bounty several times; in September, the patch shipped with no CVE, credit, or bounty. He criticizes the Apple Security Bounty program and says he waited for the patch even without a bounty, for user safety.
Timeline
First public report of an unpatched macOS zero-day that bypasses TCC.
Sources 1 source
- @Guluisacat @Guluisacat
