privilege-escalation-techniqueendpoint-software-vulnerabilityproof-of-concept-releasewidely-deployed-product-advisory

Apple MIE Bypass on macOS Achieved via SMBClient and WebDAV Flaws

Attack Tradecraft · 2 sources · Updated 3mo ago · First seen Jul 27, 2026

Researchers disclosed the first public bypass of Apple Memory Integrity Enforcement (MIE) on macOS 26.4.1 by chaining two vulnerabilities: CVE-2026-64704 in SMBClient and CVE-2026-64699 in webdavfs. The SMB flaw is a type confusion issue triggered when a macOS client connects to a malicious SMB server, causing the kernel to reinterpret a Resolve ID context as a lease context and misuse attacker-influenced kernel pointers. The WebDAV flaw is a kernel memory disclosure bug triggered by a crafted HTTP 206 response from a malicious WebDAV server, leaking uninitialized kernel memory to userspace.

The researchers said the combined exploit chain produces arbitrary kernel read/write primitives and ultimately kernel code execution, allowing an unprivileged user to escalate privileges to root despite Apple’s layered kernel protections. Apple has patched both issues in macOS 26.6, and the disclosure was accompanied by a public exploit-development challenge and notice of a planned Black Hat USA presentation detailing the technique.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jul 27, 2026

Jul 27, 20263mo ago
Black Hat USA presentation on the exploit chain is announced
The disclosure announced a full presentation at Black Hat USA scheduled for August 5, 2026. The talk would cover the two vulnerabilities and the Apple MIE bypass technique.
Apple MIE : deux vulnérabilités SMB/WebDAV permettent une LPE sur macOS 26.x | CyberVeille
Jul 27, 20263mo ago
Researchers launch public exploit-development challenge
The Calif post launched a public exploit-development challenge based on CVE-2026-64704 and CVE-2026-64699. The challenge centered on exploiting the two bugs used in the Apple MIE bypass chain.
Apple MIE : deux vulnérabilités SMB/WebDAV permettent une LPE sur macOS 26.x | CyberVeille
Jul 27, 20263mo ago
Calif publicly discloses first public Apple MIE bypass chain
On July 27, 2026, Calif Global published details of two macOS vulnerabilities chained to produce the first public bypass of Apple MIE on macOS 26.4.1. The disclosure explained that the SMBClient type confusion and WebDAV kernel memory disclosure together enabled kernel read/write primitives, kernel code execution, and escalation to root.
Apple MIE exploitation challenge - by Bruce Dang - Calif
Reported Jul 27, 20263mo ago
Apple fixes two macOS MIE-bypass vulnerabilities in macOS 26.6
Apple addressed CVE-2026-64704 in SMBClient and CVE-2026-64699 in webdavfs in macOS 26.6. The two flaws could be chained to bypass Apple Memory Integrity Enforcement and achieve local privilege escalation to root.
Apple MIE exploitation challenge - by Bruce Dang - Calif

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Kernel memory disclosure in Apple webdavfs (CVE-2026-64699)SMBClient type confusion in Apple macOS (CVE-2026-64704)

Affected products

1 linked

Macos

Organizations

1 linked

Apple

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

CyberveilleNews · Jul 28, 2026

Apple MIE : deux vulnérabilités SMB/WebDAV permettent une LPE sur macOS 26.x | CyberVeilleOpen source ↗

Calif BlogNews · Jul 27, 2026

Apple MIE exploitation challenge - by Bruce Dang - CalifOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News