What is the CVSS score of CVE-2026-28823?

CVE-2026-28823 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28823?

Organizations using A path handling should be aware of moderate risk from CVE-2026-28823, a improper access control vulnerability rated CVSS 4.9.. A patch is available.

How to fix or mitigate CVE-2026-28823?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28823

EUVD-2026-15089 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-j9xp-j7mg-j47f

Apple Authentication Bypass macOS

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15089

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 4.9

DescriptionCVE.org

A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protected system files.

AnalysisAI

Root-privileged applications on Apple macOS can bypass path validation to delete protected system files due to insufficient input sanitization. This affects macOS Tahoe 26.4 and requires the attacker to already have root-level access, limiting the attack surface to local privilege escalation scenarios. No patch is currently available.

Technical ContextAI

The vulnerability exists in macOS file system path handling logic, where insufficient validation of file paths permits an application running with root-level privileges to bypass protections designed to safeguard critical system files. The issue is classified under path handling/validation weaknesses (conceptually related to CWE-22 Improper Limitation of a Pathname to a Restricted Directory, though CWE was not formally assigned). The affected product is Apple macOS across multiple versions prior to the Tahoe 26.4 release, as indicated by the CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* which shows vulnerability in macOS across all affected version branches until the patch was applied.

RemediationAI

Users should update macOS to version Tahoe 26.4 or later, which contains the improved path validation logic that addresses this vulnerability. This can be done through System Settings > General > Software Update on affected macOS devices. For enterprise environments, deploy this update via Mobile Device Management (MDM) or your internal software distribution system. Until patching is completed, restrict root-level application execution to only trusted, code-signed binaries and monitor file system access to protected directories using audit logging. Organizations handling sensitive data should prioritize this patch within their standard macOS update windows.