What is the CVSS score of CVE-2026-28818?

CVE-2026-28818 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28818?

Organizations using A logging should be aware of moderate risk from CVE-2026-28818, a improper access control vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-28818?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28818

EUVD-2026-15081 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-v87q-9639-7vgq

Apple Authentication Bypass macOS

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15081

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

A logging issue in Apple macOS allows applications to access sensitive user data that should have been redacted from logs. The vulnerability affects macOS Sequoia (versions before 15.7.5), macOS Sonoma (versions before 14.8.5), and macOS Tahoe (versions before 26.4). An attacker controlling a malicious app could exploit improper data redaction in system logging to exfiltrate sensitive information that was intended to be masked.

Technical ContextAI

This vulnerability stems from insufficient data redaction mechanisms in macOS logging infrastructure. The root cause is classified under information disclosure weaknesses where sensitive data is inadequately sanitized before being written to application-accessible logs. The affected technology spans the entire macOS operating system (CPE: cpe:2.3:a:apple:macos), indicating the vulnerability affects core logging subsystems used across multiple macOS versions. Rather than a specific library or protocol, this is a systemic issue where Apple's logging framework failed to properly implement data masking for sensitive fields, allowing applications with logging access to reconstruct or read confidential user information.

RemediationAI

Immediately upgrade to the patched macOS versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later, depending on your current installation. Enable automatic security updates in System Settings under General > Software Update > Automatic Updates to receive patches immediately upon release. As an interim measure prior to patching, restrict the installation of third-party applications from untrusted sources and review app permissions in System Settings > Privacy & Security. For enterprise deployments, leverage Mobile Device Management (MDM) solutions to enforce rapid deployment of security updates across all managed macOS devices. Users should reference Apple's official security updates at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed patch notes and update procedures.