EUVD-2026-15081
GHSA-v87q-9639-7vgq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are not publicly available for this CVE, the risk assessment must rely on the vulnerability characteristics and Apple's response pattern. The attack vector appears to be local (requiring malicious app installation), which moderates immediate risk compared to remote vulnerabilities. However, the information disclosure impact is significant—sensitive user data exposure is a high-impact technical concern. Apple's decision to patch across three major OS versions (Sequoia, Sonoma, and the upcoming Tahoe) indicates this was treated as a priority fix, suggesting internal risk assessment was moderate-to-high. The lack of active exploitation indicators in public sources and the fact that this addresses a logging issue rather than a direct code execution vulnerability places this in the medium priority category. Organizations should prioritize patching, but this does not warrant emergency response procedures typical of critical vulnerabilities. |
| Exploit ScenarioDerived | A threat actor distributes a trojanized application (such as a fake productivity tool or game) through third-party app repositories or social engineering. Once installed with user consent, the malicious app accesses the improperly redacted system logs where sensitive data such as authentication tokens, API keys, or personally identifiable information persists unmasked. The attacker exfiltrates this data to a remote server, enabling account compromise or identity theft. This scenario requires user interaction (app installation) but no special privileges, making it practical for targeted attacks against specific users or organizations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A logging issue in Apple macOS allows applications to access sensitive user data that should have been redacted from logs. The vulnerability affects macOS Sequoia (versions before 15.7.5), macOS Sonoma (versions before 14.8.5), and macOS Tahoe (versions before 26.4). An attacker controlling a malicious app could exploit improper data redaction in system logging to exfiltrate sensitive information that was intended to be masked.
RemediationAI
Immediately upgrade to the patched macOS versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later, depending on your current installation. Enable automatic security updates in System Settings under General > Software Update > Automatic Updates to receive patches immediately upon release. As an interim measure prior to patching, restrict the installation of third-party applications from untrusted sources and review app permissions in System Settings > Privacy & Security. For enterprise deployments, leverage Mobile Device Management (MDM) solutions to enforce rapid deployment of security updates across all managed macOS devices. Users should reference Apple's official security updates at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed patch notes and update procedures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from insufficient data redaction mechanisms in macOS logging infrastructure. The root cause is classified under information disclosure weaknesses where sensitive data is inadequately sanitized before being written to application-accessible logs. The affected technology spans the entire macOS operating system (CPE: cpe:2.3:a:apple:macos), indicating the vulnerability affects core logging subsystems used across multiple macOS versions. Rather than a specific library or protocol, this is a systemic issue where Apple's logging framework failed to properly implement data masking for sensitive fields, allowing applications with logging access to reconstruct or read confidential user information.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Executive ViewAI
Organizations using A logging should be aware of moderate risk from CVE-2026-28818, a improper access control vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB