Apple Keychain CVE-2026-28860

Exploitation requires local access to an Apple device with an active user session (unlocked device or logged-in macOS account). The attacker must execute code on the target system, either through a malicious application installed by the user or via prior compromise. The CVSS vector indicates no privileges required (PR:N), but practical Keychain access typically requires the process to run in the user's security context with appropriate entitlements. Exploitation is limited to scenarios where the attacker has physical access to an unlocked device, has social-engineered the user into installing malicious software, or has achieved initial access through another vulnerability. The vulnerability does NOT allow remote network-based exploitation despite the CVSS AV:N rating - the description's 'local attacker' designation is authoritative. User interaction (UI:N) is not required once local code execution is achieved.

Real-world risk is significantly lower than the CVSS 7.5 score suggests due to multiple conflicting signals. The description explicitly states 'local attacker' requiring physical or prior system access, directly contradicting the CVSS vector's AV:N (network) and PR:N (no privileges required) rating. This discrepancy indicates either CVSS miscalculation or incomplete description. The EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation likelihood, consistent with local-only attack requirements. CVSS rates this as High confidentiality impact (C:H) but description says 'modify state' not 'read secrets', suggesting Integrity impact is primary concern - another vector inconsistency. No CISA KEV listing and vendor patch availability indicate this is not being actively exploited at scale. Priority should be moderate for endpoints with physical security concerns (shared workstations, mobile devices in hostile environments) but low for properly managed enterprise systems with endpoint detection. The attack requires local access plus likely specific app entitlements or user context, significantly raising exploitation complexity beyond AC:L rating.

An attacker with local access to an unlocked Apple device (or logged-in user session on macOS) executes a malicious application or script that sends specially crafted input to the Keychain service. Due to insufficient input validation, the attacker modifies Keychain state to potentially add malicious credentials, alter existing password entries, or manipulate trust settings for certificates. This could enable subsequent attacks like credential harvesting, SSL/TLS interception via trusted malicious certificates, or privilege escalation by modifying app-specific secrets. The local access requirement significantly limits opportunistic exploitation but enables targeted attacks against high-value devices.