Apple macOS Tahoe and Xcode Local Information Disclosure Vulnerabilities - CVE-2026-112602, CVE-2026-112605

Key facts for Xcode 27.2 info disclosure

Detection coverage for Xcode 27.2 info disclosure

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5454 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Symlink Toward Credential, Keychain or User-Data Store — CoreDevice CVE-2026-112605 Exploitation Precursor

Detects creation of symbolic links that point at SSH keys, GPG keys, cloud credentials, keychains or Messages/Mail data. Symlink-following arbitrary file read (CWE-59) is the vulnerability class of CVE-2026-112605 in CoreDevice (fixed in macOS Tahoe 26.6 / Xcode 27.2). A local app must first stage such a link, so this fires on the behaviour rather than on a specific exploit. Maps to local data collection (T1005), credentials in files (T1552.001), private keys (T1552.004) and keychain access (T1555.001). No exploitation is reported; this is a potential-impact detection.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1005, T1552.001, T1552.004, T1555.001
• Data sources: macos_endpoint_security, osquery_es_process_events, defender_for_endpoint_macos
• Severity: medium
• Confidence: medium

Splunk SPL

index=macos sourcetype="osquery:results" name="es_process_events" earliest=-24h
  columns.path="/bin/ln" columns.cmdline="* -s*"
| search columns.cmdline IN ("*/.ssh/*", "*/.aws/credentials*", "*/.kube/config*", "*/.config/gcloud*", "*/Library/Keychains*", "*/.docker/config.json*", "*/.netrc*", "*/.gnupg/*", "*/Library/Messages*", "*/Library/Mail*")
```Symlink to credential or user-data store; CVE-2026-112605 CWE-59 symlink-following pattern```
| eval proc_user='columns.username', symlink_cmd='columns.cmdline'
| stats count min(_time) as first_seen max(_time) as last_seen values(symlink_cmd) as symlink_commands by host, proc_user
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let sensitive = dynamic(["/.ssh/", "/.aws/credentials", "/.kube/config", "/.config/gcloud", "/Library/Keychains", "/.docker/config.json", "/.netrc", "/.gnupg/", "/Library/Messages", "/Library/Mail"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith "/"
| where FileName =~ "ln" and ProcessCommandLine has " -s"
| where ProcessCommandLine has_any (sensitive)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256

Sigma

title: macOS Symlink Created Toward Credential or User-Data Store
id: 5b0f2c1e-6a41-4d38-9c52-7e1a3d8f4b01
status: experimental
description: Detects ln -s targeting SSH keys, GPG keys, cloud credentials, keychains or Messages/Mail data, the setup step for symlink-following arbitrary file read such as CVE-2026-112605 (CoreDevice, CWE-59). Potential-impact rule; no exploitation is reported.
references:
    - https://support.apple.com/en-us/149589
    - https://nvd.nist.gov/vuln/detail/CVE-2026-112605
    - https://attack.mitre.org/techniques/T1552/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.collection
    - attack.t1005
    - attack.credential_access
    - attack.t1552.001
    - attack.t1552.004
    - attack.t1555.001
    - cve.2026.112605
logsource:
    category: process_creation
    product: macos
detection:
    sel_img:
        Image|endswith:
            - '/ln'
    sel_flag:
        CommandLine|contains:
            - ' -s'
    sel_path:
        CommandLine|contains:
            - '/.ssh/'
            - '/.aws/credentials'
            - '/.kube/config'
            - '/.config/gcloud'
            - '/Library/Keychains'
            - '/.docker/config.json'
            - '/.netrc'
            - '/.gnupg/'
            - '/Library/Messages'
            - '/Library/Mail'
    condition: sel_img and sel_flag and sel_path
falsepositives:
    - Administrators relocating dotfiles or SSH config into a managed directory
    - Dotfile managers and backup tools linking config files
level: medium

Known false positives:

• Dotfile managers (stow, chezmoi) linking ~/.ssh or ~/.aws config
• Admins relocating credential directories with ln -s

Tuning notes: Adjust index, sourcetype and the name filter to your osquery or Endpoint Security telemetry. Exclude known dotfile-management accounts or parent tools. Extend the path list with in-house secret stores. Prioritise hosts still on Xcode < 27.2 or macOS Tahoe < 26.6.

• 🔒 User-Run App Bundle from Untrusted Location Spawning Shell or File-Access Tools — CVE-2026-112602 / CVE-2026-112605 Precondition · unlock with TL Creds
• 🔒 CoreDevice devicectl/coredeviced Referencing Sensitive Paths — CVE-2026-112605 · unlock with TL Creds
• 🔒 Bulk Copy or Archive of Messages/Mail/Safari/Cookie Data — Sensitive User Data Collection · unlock with TL Creds
• 🔒 Direct Read or Copy of Credential, Key and Keychain Files on macOS · unlock with TL Creds
• 🔒 macOS Authorization State Tampering — authorizationdb write, DevToolsSecurity, Developer/Admin Group Edits · unlock with TL Creds
• 🔒 Gatekeeper Bypass — Quarantine Attribute Removal via xattr or spctl Assessment Changes · unlock with TL Creds
• 🔒 Instruments / xctrace Profiling Other Processes — CVE-2026-112602 Authorization Abuse Surface · unlock with TL Creds
• 🔒 Credential and Private-Key Hunting via find/grep/mdfind — Post-Read Discovery · unlock with TL Creds

Indicators of compromise for Xcode 27.2 info disclosure

As of 2026-11-06, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5454.

How Xcode 27.2 info disclosure works

Apple's security content for Xcode 27.2 (released 2026-10-29, availability: macOS Tahoe 26.6 and later) lists two issues. CVE-2026-112602 is in the Instruments component: an authorization issue (CWE-285) that allowed an app to access sensitive user data, fixed with improved state management in authorization processes. Reporter: Roelof van Dijk.

CVE-2026-112605 is in the CoreDevice component: improper symlink handling (CWE-59, improper link resolution before file access) that allowed an app to read arbitrary files, fixed with improved handling of symlinks. Reporter: Vladislav Shevchenko (Positive Technologies).

NVD published both records on 2026-10-30 (last modified 2026-11-04) and scores both CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (3.3 LOW): local access, user interaction, limited confidentiality impact only. The NVD CPE configuration for both is apple:xcode versions below 27.2. For CVE-2026-112602 the NVD record carries an SSVC assessment of no evidence of exploitation and partial technical impact; the CVE-2026-112605 record was still marked Awaiting Analysis when reviewed. GovCERT.HK alert A26-10-66 (2026-10-30) states that, depending on the vulnerabilities exploited, an attack could lead to remote code execution or information disclosure. The vendor and NVD descriptions support information disclosure only, so this record follows the vendor.

No active exploitation, public PoC, threat actor attribution, or network/file IOCs are stated in any source. The CISA KEV catalog (version 2026.11.06) was checked; neither CVE appeared in the portion of the catalog that could be read, so a KEV listing is not confirmed. The MITRE ATT&CK mappings on this record are potential-impact mappings derived from the vendor-described capability (a locally run app reading data it should not be able to reach) and are not evidence of in-the-wild use. The IOC entries list the affected components, products and credited parties for asset-inventory and patch-hunting purposes, not attacker infrastructure. Remediation is to update to macOS Tahoe 26.6 and Xcode 27.2.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1204.002 User Execution: Malicious File

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation for Xcode 27.2 info disclosure

Patches

• macOS Tahoe 26.6
• Xcode 27.2

Immediate actions

• Apply macOS Tahoe 26.6 and Xcode 27.2 via auto-update

Longer-term hardening

• Keep developer workstations on current Xcode and macOS releases
• Inventory Xcode and macOS versions across developer fleets

Affected and fixed versions

• Apple — Xcode
  Vulnerable versions: prior to 27.2
  Fixed in: 27.2
• Apple — macOS Tahoe
  Vulnerable versions: prior to 26.6
  Fixed in: 26.6

Timeline of Xcode 27.2 info disclosure

• 2026-10-29 locked-ioc-11 credits locked-ioc-6 (CVE-2026-112602) and locked-ioc-3 of locked-ioc-2 (CVE-2026-112605) for reporting the issues
• 2026-10-29 locked-ioc-11 releases locked-ioc-8 (availability: locked-ioc-5 and later) with fixes for CVE-2026-112602 (locked-ioc-7) and CVE-2026-112605 (locked-ioc-9)
• 2026-10-30 locked-ioc-10 publishes alert A26-10-66 recommending immediate patching of locked-ioc-1 and locked-ioc-4
• 2026-10-30 NVD publishes CVE-2026-112602 and CVE-2026-112605, both CVSS 3.3 LOW with CPE locked-ioc-11:xcode below 27.2
• 2026-11-04 NVD last modifies both records; CVE-2026-112602 carries an SSVC assessment of no evidence of exploitation and partial technical impact, while CVE-2026-112605 remains Awaiting Analysis
• 2026-11-06 Source review finds no reported exploitation, public PoC or attribution for either CVE
• 2026-11-06 CISA KEV catalog version 2026.11.06 reviewed; neither CVE appeared in the portion of the catalog that could be read

Sources cited for Xcode 27.2 info disclosure

• GovCERT.HK Security Alert A26-10-66: Multiple Vulnerabilities in Apple Products govcert.gov.hk · Advisory · 2026-10-30
• NVD CVE-2026-112602 NVD (NIST) · Advisory · 2026-10-30
• NVD CVE-2026-112605 NVD (NIST) · Advisory · 2026-10-30
• CVE-2026-112602 (MITRE) MITRE · Advisory · 2026-10-30
• CVE-2026-112605 (MITRE) MITRE · Advisory · 2026-10-30
• CISA Known Exploited Vulnerabilities Catalog (checked 2026-11-06) CISA · Government advisory · 2026-11-06
• Apple Security Content: Xcode 27.2 Apple · Vendor report · 2026-10-29

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Previous and next in vulnerability

• Vulnerability in F5 Products (CVE-2020-26116) - Python http.client CRLF Injection in BIG-IP Next SPK, BIG-IQ, F5OS-A, F5OS-C Previous report
• Multiple Vulnerabilities in Google Chrome (prior to 156.0.8078.79) - CVE-2026-76024 to CVE-2026-76031, CVE-2026-119260 to CVE-2026-119272 Next report