What is CVE-2026-8635?

CVE-2026-8635 is a critical-severity vulnerability in Apple macOS, classified under Code Injection. CVSS score: 9.9/10. Published 2026-07-17.

How severe is CVE-2026-8635?

Critical severity. CVSS v3 base score is 9.9 out of 10.

RCE in Apple macOS

CVE-2026-8635

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.005 (42.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Apple Macos
Ibm Langflow Oss — versions 1.0.0
Langflow
Linux Linux_kernel
Microsoft Windows

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@us.ibm.com (vendor-advisory, patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-8635?: CVE-2026-8635 is a critical-severity vulnerability in Apple macOS, classified under Code Injection. CVSS score: 9.9/10. Published 2026-07-17.
How severe is CVE-2026-8635?: Critical severity. CVSS v3 base score is 9.9 out of 10.