What is the CVSS score of CVE-2026-28821?

CVE-2026-28821 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28821?

CVE-2026-28821 is a high-severity privilege escalation vulnerability in macOS that allows applications to bypass system privilege checks and gain elevated access.. A patch is available.

How to fix or mitigate CVE-2026-28821?

Within 24 hours: Identify all macOS systems running Sequoia 15.7.4 or earlier, Sonoma 14.8.4 or earlier, or Tahoe 26.3 or earlier. Within 7 days: Deploy patches to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 across all affected systems using your MDM or patch management platform. Within 30 days: Verify patch deployment completion and confirm entitlement verification validation through security assessments.

macOS CVE-2026-28821

EUVD-2026-15085 HIGH

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-7jx6-r36g-7pwq

Apple Authentication Bypass macOS

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15085

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 8.4

DescriptionCVE.org

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain elevated privileges.

AnalysisAI

A validation flaw in macOS entitlement verification allows applications to bypass privilege checks and gain elevated system privileges. The vulnerability affects macOS Sequoia 15.7.4 and earlier, macOS Sonoma 14.8.4 and earlier, and macOS Tahoe 26.3 and earlier. Apple has addressed this issue through improved validation of process entitlements in patched versions (15.7.5, 14.8.5, and 26.4 respectively), but no CVSS score, EPSS data, or KEV inclusion status is currently available, limiting immediate risk quantification.

Technical ContextAI

The vulnerability resides in macOS's entitlement verification subsystem, a security mechanism responsible for enforcing application sandbox restrictions and privilege boundaries. Entitlements are cryptographically signed declarations embedded in application code signatures that define which system APIs and resources an app may access. The CWE classification is not specified, but the description indicates an improper validation issue (likely CWE-347: Improper Verification of Cryptographic Signature or CWE-439: Attribute Validation Using an Incorrect Regular Expression). The affected CPE (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) indicates this flaw affects multiple macOS major versions. The kernel and code-signing subsystem are the likely technical components involved, as they enforce entitlement checks at process launch and during privileged operations.

RemediationAI

Users must upgrade immediately to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.4 or later, or macOS Tahoe 26.4 or later, depending on their installed macOS version. Patch availability is confirmed through Apple's official security advisories linked above (https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, https://support.apple.com/en-us/126796). For organizations unable to immediately patch, mitigation strategies include restricting execution of untrusted applications, enforcing System Integrity Protection (SIP) and Gatekeeper at their strictest settings, limiting user account privileges to standard (non-administrative) levels, and deploying Mobile Device Management (MDM) to enforce security policies and control application execution. No workarounds exist to disable entitlement checking without compromising macOS security architecture.