macOS CVE-2026-28840

Requires existing local access to macOS system with valid low-privilege user credentials (CVSS PR:L). The attacker must execute an application or binary in the context of an authenticated user account - cannot be exploited remotely or without prior system access. No special configuration or non-default settings required (CVSS AC:L), meaning default macOS installations are vulnerable. No user interaction needed once local access is established (CVSS UI:N). The local attack vector (AV:L) fundamentally limits exploitation to scenarios where attackers have already achieved initial access through other means (social engineering, supply chain compromise, physical access, or exploitation of separate remote vulnerabilities). This is a post-compromise escalation tool, not an entry point.

Real-world risk is moderate despite high CVSS 7.8 score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms local access with low-privilege authentication required but low attack complexity once obtained. EPSS 0.01% (3rd percentile) indicates extremely low observed exploitation probability in the wild, suggesting this is not being actively weaponized. No CISA KEV listing and no public exploit identified, reducing immediate urgency. However, the attack vector limitation is significant: attackers need existing local access with valid user credentials before exploiting this flaw. This positions CVE-2026-28840 as a post-exploitation or privilege escalation component within multi-stage attacks rather than an initial access vector. SSVC assessment: exploitation status is none public, automatable is no (requires local access setup), technical impact is total (root access). Priority should be HIGH for managed endpoints where users have local accounts, but MEDIUM-LOW for environments with strong perimeter controls and limited local user privileges. The low EPSS despite high CVSS suggests this is theoretical risk rather than observed threat - patch during regular maintenance cycles unless your threat model includes sophisticated adversaries already possessing local access.

An attacker who has already compromised a standard user account on a macOS system (through phishing, stolen credentials, or initial malware deployment) executes a malicious application that exploits the permissions flaw. The application leverages the improper privilege management to bypass macOS authorization checks and escalates from standard user context to root privileges without requiring administrator credentials or user interaction. With root access established, the attacker can disable security controls, install persistent backdoors, access all user data, and achieve complete system compromise.