What is the CVSS score of CVE-2026-28837?

CVE-2026-28837 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28837?

CVE-2026-28837 is a logic flaw in macOS Tahoe (versions prior to 26.4) that enables unauthorized applications to bypass security controls and access sensitive user data, creating direct risk to…. A patch is available.

How to fix or mitigate CVE-2026-28837?

Within 24 hours: Identify all macOS Tahoe systems in your environment running versions prior to 26.4 and inventory affected devices. Within 7 days: Obtain and test macOS Tahoe version 26.4 or later in a controlled environment to validate compatibility with critical applications. Within 30 days: Deploy macOS Tahoe 26.4+ patch to all affected systems using your standard change management process, prioritizing systems with elevated data sensitivity.

macOS CVE-2026-28837

EUVD-2026-15109 HIGH

Improper Access Control (CWE-284)

2026-03-25 apple

Apple Authentication Bypass macOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15109

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

A logic flaw in macOS Tahoe allows applications to bypass security controls and access sensitive user data without proper authorization. The vulnerability affects macOS versions prior to 26.4 and is addressed through improved input validation and access control checks. While CVSS scoring data is unavailable, Apple has released a patch indicating this is a genuine security concern requiring immediate attention.

Technical ContextAI

This vulnerability represents an information disclosure flaw within macOS system architecture, specifically classified as a logic issue rather than a memory safety or cryptographic weakness. The affected product is Apple macOS (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), spanning multiple versions up to and including those prior to macOS Tahoe 26.4. While the CWE classification is not specified in available sources, the description of 'improved checks' suggests the root cause involves insufficient validation of application entitlements, sandbox escape conditions, or inadequate permission verification mechanisms. The fix involves tightening logical gates that control sensitive data access, indicating the original code likely failed to properly enforce authorization boundaries between application contexts and protected user information stores.

RemediationAI

Immediately upgrade to macOS Tahoe 26.4 or any later version to obtain the patched logic controls that restrict unauthorized data access. macOS users should enable automatic security updates through System Settings > General > Software Update > Automatic Updates to ensure timely patch deployment. Until systems can be updated, restrict app installations to trusted sources only, review and revoke unnecessary app permissions through System Settings > Privacy and Security, and monitor system logs for suspicious data access patterns. For enterprise environments, deploy this patch through Mobile Device Management (MDM) solutions prioritizing business-critical systems, and reference Apple's security advisory at https://support.apple.com/en-us/126794 for deployment guidance.