What is the CVSS score of CVE-2026-28839?

CVE-2026-28839 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28839?

Organizations using The should be aware of moderate risk from CVE-2026-28839 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-28839?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28839

EUVD-2026-15113 MEDIUM

Improper Authorization (CWE-285)

2026-03-25 apple

GHSA-p882-fhhg-97p6

Apple Authentication Bypass macOS

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,26.4,14.8.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15113

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

This vulnerability allows unauthorized applications to access sensitive user data on affected macOS systems through improved security checks that were insufficient in earlier versions. The issue affects macOS Sequoia (versions prior to 15.7.5), macOS Sonoma (versions prior to 14.8.5), and macOS Tahoe (versions prior to 26.4). An attacker with the ability to execute a malicious application on a vulnerable system could potentially read or exfiltrate sensitive user information that should be protected by macOS security controls. There is no evidence of active exploitation in the wild or public proof-of-concept availability, and the limited disclosure details suggest Apple addressed this proactively before widespread abuse.

Technical ContextAI

This vulnerability is rooted in insufficient access control mechanisms within the macOS operating system kernel or framework-level security enforcement (consistent with Information Disclosure classification). The affected products span three major macOS versions as identified by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, indicating the issue was systemic across multiple release branches rather than isolated to a single component. The vulnerability appears to relate to a generic access control or permission-checking flaw rather than a specific library or protocol—Apple's remediation language ('improved checks') suggests the fix involved tightening validation logic that previously allowed unauthorized data access. The absence of a CWE designation in available data suggests either a custom or composite weakness not easily mapped to standard CWE categories, or that Apple did not publicly disclose the precise technical root cause to prevent copycat vulnerabilities.

RemediationAI

Immediately update to macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later, depending on your current version. Updates are available through System Preferences > General > Software Update or by visiting https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796. Until patching is completed, users should minimize installation of untrusted third-party applications, review application permissions in System Preferences > Security & Privacy > Privacy, and disable or remove applications that request excessive access to system data. Organizations deploying macOS can accelerate patching through MDM (Mobile Device Management) solutions to enforce mandatory updates. No behavioral workarounds fully mitigate the vulnerability short of patching, so expedited deployment is recommended.