EUVD-2026-15141Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While formal CVSS scoring and EPSS data are unavailable, the vulnerability presents significant real-world risk due to multiple factors: (1) the attack vector is local, requiring an attacker to have already gained execution on the target device, which substantially reduces the overall attack surface compared to remote exploits; (2) the technical impact is severe—unauthorized access to all user Keychain items represents complete credential compromise; (3) exploitation is likely automatable once a local foothold is established, as the permissions bypass requires only programmatic API calls; (4) the vulnerability has been patched across all major Apple platforms, indicating the vendor assessed it as a legitimate security issue requiring rapid remediation; (5) no evidence of active KEV exploitation or public proof-of-concept exists, suggesting low current threat likelihood but high potential impact if exploited. For organizations managing Apple devices, this is a high-priority patch despite the local-only attack vector, as it degrades a cornerstone of Apple's multi-layered security architecture. |
| Exploit ScenarioDerived | An attacker who has gained local code execution on an iPhone (via a malicious app installed from outside the App Store, a jailbreak, or physical access to an unlocked device) can leverage this Keychain permissions bypass to systematically enumerate and extract all stored credentials, including banking passwords, authentication tokens for cloud services, and VPN credentials belonging to the device owner. Once extracted, the attacker can impersonate the user across multiple services without requiring additional authentication, leading to unauthorized access to email, financial accounts, and corporate resources. No complex exploit chain is required beyond initial local code execution—the vulnerability is straightforward to trigger programmatically. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A local privilege escalation vulnerability in Apple's Keychain implementation allows an attacker with local access to bypass permissions checking and retrieve sensitive stored credentials and secrets. The vulnerability affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, macOS Tahoe 26.4 and earlier, visionOS 26.4 and earlier, and watchOS 26.4 and earlier. No public exploitation has been confirmed, and patched versions are now available across all affected platforms.
RemediationAI
Immediately update all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.4 or later, macOS to 15.7.5 (Sequoia), 14.8.5 (Sonoma), or 26.4 (Tahoe) or later, visionOS to 26.4 or later, and watchOS to 26.4 or later. Organizations should prioritize patching devices that store sensitive credentials or access corporate resources. Until updates can be deployed, implement additional mitigations by restricting physical and remote access to devices, disabling untrusted app installations, enforcing Mobile Device Management (MDM) policies to prevent installation of suspicious applications, and ensuring users do not grant excessive permissions to third-party apps. Consult Apple's official advisories at the links provided above for platform-specific patch deployment procedures and any interim guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Apple's Keychain services framework, a core credential storage and retrieval subsystem present across iOS, iPadOS, macOS, visionOS, and watchOS platforms (identified via CPE strings covering cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos). The root cause is an improper access control mechanism in the Keychain's permission validation logic, classified as an Information Disclosure vulnerability. Keychain stores highly sensitive data including passwords, authentication tokens, cryptographic keys, and payment information. The flaw allows circumvention of the sandbox and per-app isolation that normally restricts one application's access to another application's stored secrets, which is a violation of Apple's fundamental security model.
Know when Visionos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
2DescriptionCVE.org
This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items.
Executive ViewAI
CVE-2026-28864 is a low-severity vulnerability in This (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
A critical out-of-bounds write in WebKit's rendering engine allows maliciously crafted web content to escape the Web Con
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Arbitrary code execution in Apple Safari, iOS/iPadOS, macOS Sequoia, and visionOS occurs when processing maliciously cra
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pa
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
A cookie management issue was addressed with improved state management. Rated medium severity (CVSS 6.3), this vulnerabi
A denial of service vulnerability in This (CVSS 4.2). Risk factors: actively exploited (KEV-listed).
A logic issue was addressed with improved state management. Rated critical severity (CVSS 9.8), this vulnerability is re
An out-of-bounds write issue was addressed with improved input validation. Rated high severity (CVSS 7.8), this vulnerab
GitHub PoC
Exploit-DB