What is the CVSS score of CVE-2026-28817?

CVE-2026-28817 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28817?

CVE-2026-28817 is a macOS sandbox escape vulnerability affecting Sequoia, Sonoma, and Tahoe that allows local attackers to execute arbitrary operations with elevated privileges, directly undermining…. A patch is available.

How to fix or mitigate CVE-2026-28817?

Within 24 hours: Inventory all macOS systems running Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 and restrict local user access to business-critical systems. Within 7 days: Deploy Apple security updates to Sequoia 15.8+, Sonoma 14.9+, or Tahoe 26.5+ (exact patch versions to be confirmed from Apple Security Updates page) to all affected devices; prioritize systems handling sensitive data or administrative functions. Within 30 days: Complete remediation of all in-scope macOS devices; validate patch deployment and conduct endpoint detection review for lateral movement indicators.

macOS CVE-2026-28817

EUVD-2026-15079 HIGH

Race Condition (CWE-362)

2026-03-25 apple

GHSA-p8x5-crg3-hj6v

Apple Race Condition Information Disclosure macOS

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,15.7.5,26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15079

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 8.1

DescriptionCVE.org

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A sandboxed process may be able to circumvent sandbox restrictions.

AnalysisAI

Sandboxed processes on Apple macOS (Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4) can escape sandbox isolation due to a race condition in state handling, allowing local attackers to bypass security restrictions and potentially execute arbitrary operations with elevated privileges. No patch is currently available for affected systems. The vulnerability requires local access and specific timing conditions but carries high impact across confidentiality, integrity, and availability.

Technical ContextAI

The vulnerability is rooted in a race condition (CWE category involving timing-dependent state management) within macOS kernel or system service components that enforce sandbox isolation policies. macOS sandboxing (Seatbelt framework) relies on precise state management to restrict process capabilities; when concurrent operations on sandbox state occur without proper synchronization, a process can exploit the window between security checks and enforcement to execute privileged operations. The affected products per CPE specification (cpe:2.3:a:apple:macos) span multiple major versions, indicating the flaw exists in core OS components rather than isolated user-space libraries. The race condition likely involves file descriptor tables, entitlement validation, or capability bitmap updates that are checked and then modified without atomic protection.

RemediationAI

Immediately update to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4 or later through System Preferences > General > Software Update. Organizations should prioritize patching systems running older major versions (Sonoma and earlier) as they pose the highest residual risk. Until patching is feasible, limit the installation and execution of untrusted applications, monitor system calls and privilege escalation attempts using macOS security tools (e.g., Activity Monitor, system logs in Console.app), and restrict user account privileges to standard user roles rather than administrator accounts where possible. Refer to Apple's official security advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed patching guidance and rollout timelines.