macOS CVE-2026-28831

This vulnerability warrants moderate-to-high priority despite the absence of traditional CVSS and EPSS metrics. Several contextual signals indicate real exploitability: (1) Apple patched three concurrent OS versions within a single advisory cycle, suggesting broad impact; (2) the vulnerability class (authorization bypass via state management) is typically automatable and low-complexity to exploit; (3) the impact is confidentiality-focused (sensitive user data access), a high-value target for malicious apps; (4) the attack vector is application-level, meaning a malicious or compromised third-party app can trigger the flaw without user interaction beyond installation. The lack of public CVSS/EPSS scores and KEV status does not diminish risk—Apple's confidential handling suggests either recent discovery or active exploitation concerns. Per SSVC logic: exploitation is likely possible (similar flaws recur), impact is high (data disclosure), and automatable by app developers. Organizations should prioritize patching as though this were a CVSS 7.0+ issue.

A malicious or compromised third-party application installed from the App Store or elsewhere could exploit this state management flaw to access protected user data (such as contacts, location history, or keychain credentials) without triggering the normal macOS authorization prompts or runtime privacy restrictions. The attacker would not require user interaction beyond initial app installation; once running, the app could silently exfiltrate sensitive information by leveraging the authorization bypass. This scenario is particularly dangerous because users trust that macOS's privacy frameworks prevent unauthorized data access, yet this flaw undermines that assumption.