What is the CVSS score of CVE-2026-28855?

CVE-2026-28855 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28855?

CVE-2026-28855 is a permissions bypass vulnerability in Apple iOS, iPadOS, and macOS that allows malicious applications to access protected user data (contacts, location, photos) without proper…. A patch is available.

How to fix or mitigate CVE-2026-28855?

Within 24 hours: Identify all iOS, iPadOS, and macOS devices running versions prior to 26.3 in your organization. Within 7 days: Prioritize patching to iOS 26.3 or later, iPadOS 26.3 or later, and macOS Tahoe 26.3 or later on all corporate and BYOD Apple devices; coordinate with MDM/device management systems to enforce updates. Within 30 days: Complete patching across all affected Apple devices; conduct audit of installed applications for suspicious behavior; communicate privacy incident response procedures to users.

macOS CVE-2026-28855

EUVD-2026-15125 HIGH

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-p843-7pmp-82hg

Apple Authentication Bypass macOS iOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.3

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15125

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3. An app may be able to access protected user data.

AnalysisAI

A permissions enforcement vulnerability in Apple's operating systems allows applications to bypass access controls and read protected user data without proper authorization. The issue affects iOS and iPadOS versions prior to 26.3, and macOS Tahoe prior to 26.3. An attacker with a malicious app could exploit insufficient permission restrictions to access sensitive user information such as contacts, location data, photos, or other protected resources that should require explicit user consent.

Technical ContextAI

This vulnerability represents a permissions/access control bypass issue at the operating system level, affecting Apple's core permission enforcement mechanisms across iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*) and macOS (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*). The root cause falls under information disclosure vulnerabilities where the OS fails to properly validate or enforce privacy permissions before granting application access to protected user data. Rather than a specific library or protocol flaw, this is a systemic permissions validation issue in Apple's privacy framework that controls which apps can access sensitive data categories. The vulnerability suggests that the permission prompt or subsequent permission check mechanisms were not adequately restricting data access as intended.

RemediationAI

Immediately upgrade to iOS 26.3, iPadOS 26.3, or macOS Tahoe 26.3 or later to receive the permissions enforcement patches. Users should navigate to Settings > General > Software Update on iOS/iPadOS devices or System Settings > General > Software Update on macOS to install the latest available version. Until patching is completed, users should review installed applications and revoke permissions for any unfamiliar or untrusted apps via Settings > Privacy on iOS/iPadOS or System Settings > Privacy & Security on macOS. Enterprise administrators should deploy Mobile Device Management (MDM) policies to enforce OS updates across managed devices and restrict installation of apps from untrusted sources. See Apple's security advisories at https://support.apple.com/en-us/126346 and https://support.apple.com/en-us/126348 for detailed patching timelines and build numbers.