EUVD-2026-15089
GHSA-j9xp-j7mg-j47f
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While formal CVSS and EPSS scores are not available for this CVE, the risk profile is moderate to high when contextual factors are considered. The vulnerability requires that an attacker first compromise or deploy a malicious application with root privileges, which is a significant barrier in most macOS environments due to code-signing and Gatekeeper protections. However, once root access is obtained, the impact is severe—deletion of protected system files could render the system unstable or inoperable. The absence of public POC code and KEV listing suggests this is not currently being exploited in the wild, keeping real-world risk lower despite the high potential impact. This should be treated as a priority patch for systems in high-security environments but not as an emergency for standard users. |
| Exploit ScenarioDerived | An attacker first gains root-level code execution on a target macOS system through a separate vulnerability (such as a kernel exploit or privilege escalation) or through social engineering (tricking a user into installing a malicious app that requests admin rights). The malicious root-level process then exploits the insufficient path validation in the file system API to craft and execute a path that deletes or modifies critical system files such as kernel extensions, system binaries, or configuration files. This could lead to system crashes, denial of service, or further compromise of system integrity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Root-privileged applications on Apple macOS can bypass path validation to delete protected system files due to insufficient input sanitization. This affects macOS Tahoe 26.4 and requires the attacker to already have root-level access, limiting the attack surface to local privilege escalation scenarios. No patch is currently available.
Earlier versions of this analysis (1)
A path handling validation flaw in macOS Tahoe allows applications with root privileges to delete protected system files that should be restricted from modification. This vulnerability affects macOS versions prior to 26.4 and could enable privilege-escalation attacks or system instability if a compromised or malicious root-level application exploits the insufficient path validation. No public exploit code or active exploitation has been documented at this time.
RemediationAI
Users should update macOS to version Tahoe 26.4 or later, which contains the improved path validation logic that addresses this vulnerability. This can be done through System Settings > General > Software Update on affected macOS devices. For enterprise environments, deploy this update via Mobile Device Management (MDM) or your internal software distribution system. Until patching is completed, restrict root-level application execution to only trusted, code-signed binaries and monitor file system access to protected directories using audit logging. Organizations handling sensitive data should prioritize this patch within their standard macOS update windows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in macOS file system path handling logic, where insufficient validation of file paths permits an application running with root-level privileges to bypass protections designed to safeguard critical system files. The issue is classified under path handling/validation weaknesses (conceptually related to CWE-22 Improper Limitation of a Pathname to a Restricted Directory, though CWE was not formally assigned). The affected product is Apple macOS across multiple versions prior to the Tahoe 26.4 release, as indicated by the CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* which shows vulnerability in macOS across all affected version branches until the patch was applied.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protected system files.
Executive ViewAI
Organizations using A path handling should be aware of moderate risk from CVE-2026-28823, a improper access control vulnerability rated CVSS 4.9. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB