What is the CVSS score of CVE-2026-28862?

CVE-2026-28862 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28862?

Organizations using A privacy should be aware of moderate risk from CVE-2026-28862, a improper access control vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-28862?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28862

EUVD-2026-15137 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-pwfm-qvvq-w8j5

Apple Information Disclosure Authentication Bypass macOS

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,15.7.5,26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15137

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access user-sensitive data.

AnalysisAI

This vulnerability is a privacy issue in Apple macOS where improved private data redaction for log entries was not properly implemented, allowing applications to potentially access user-sensitive data that should have been redacted. The vulnerability affects macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4, with no public indicators of active exploitation or proof-of-concept code. While CVSS and EPSS scores are unavailable, the nature of the issue suggests moderate real-world risk due to its reliance on application-level exploitation requiring user interaction or system access.

Technical ContextAI

The vulnerability exists in Apple's macOS logging infrastructure (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), which is responsible for generating and storing system and application log entries. The root cause appears to fall under Information Disclosure (CWE category), specifically inadequate data sanitization in log redaction mechanisms. When applications generate logs containing sensitive user information such as authentication tokens, personal identifiers, or private data, the operating system is expected to redact these values before storing them in accessible log files. The flaw in the redaction process allows applications to bypass or circumvent this privacy protection, potentially exposing sensitive data in plaintext within log entries that may be accessible to other applications or users.

RemediationAI

Users should immediately update their macOS systems to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Updates can be applied through System Preferences > Software Update or by visiting https://support.apple.com/en-us/126794 (Sequoia), https://support.apple.com/en-us/126795 (Sonoma), and https://support.apple.com/en-us/126796 (Tahoe). Until patching is feasible, organizations should restrict access to system log files through proper file permissions and access control lists, limit which applications are granted logging permissions, and avoid storing sensitive data (credentials, PII) in contexts that trigger system logging. For development teams, audit applications to ensure they do not rely on log file contents for sensitive information recovery.