PULSE
ES
FEED
ransomrhysida reclama a INTAX, Inc. · Financial Servicesransomkrybit reclama a www.viehhauser-kfz.at · AT · Transportationransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransomrhysida reclama a INTAX, Inc. · Financial Servicesransomkrybit reclama a www.viehhauser-kfz.at · AT · Transportationransombooba project reclama a LifeFone · US · Healthcareransombooba project reclama a National Association of Credit Management · US · Financial Servicesransombooba project reclama a California School Boards Association · US · Educationransombooba project reclama a South Weber City · US · Government & Defenseransombooba project reclama a Programs for Parents, Inc. · US · Educationransombooba project reclama a Circleville Police Department · US · Government & Defenseransomemperador reclama a MAA Group Consulting Engineers · Professional Servicesransomrhysida reclama a ClaimTek Systems · Financial Servicesransomlockbit5 reclama a xspringcapital.com · SG · Financial Servicesransomlockbit5 reclama a susannecerda.com · MXransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Services
← All CVEs
CVE WatchOct 8, 2026

CVE-2025-43281

The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate the

CVSS

7.8

High

EPSS

0.1%

p4

KEV

—

Exploit Today

1

0-100

Published: Oct 15, 2025 · Last modified: Oct 8, 2026 · CWE-287

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-09-302026-10-28
Technical description

The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be able to elevate their privileges.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-936809.8 CRI
—
———IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.3hCVE-2026-908624.3 MED
—
———Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.3hCVE-2026-842966.8 MED
—
———Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.3hCVE-2026-8429510.0 CRI
—
———Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.3hCVE-2026-1102457.5 HIG
—
———IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.3hCVE-2026-889286.5 MED
—
——0The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.4h