What is the CVSS score of CVE-2026-28864?

CVE-2026-28864 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28864?

CVE-2026-28864 is a low-severity vulnerability in This (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate CVE-2026-28864?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

macOS CVE-2026-28864

EUVD-2026-15141 LOW

Incorrect Authorization (CWE-863)

2026-03-25 apple

Apple Authentication Bypass macOS iOS

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,14.8.5,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15141

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:35 nvd

LOW 3.3

DescriptionCVE.org

This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items.

AnalysisAI

A local privilege escalation vulnerability in Apple's Keychain implementation allows an attacker with local access to bypass permissions checking and retrieve sensitive stored credentials and secrets. The vulnerability affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, macOS Tahoe 26.4 and earlier, visionOS 26.4 and earlier, and watchOS 26.4 and earlier. No public exploitation has been confirmed, and patched versions are now available across all affected platforms.

Technical ContextAI

The vulnerability resides in Apple's Keychain services framework, a core credential storage and retrieval subsystem present across iOS, iPadOS, macOS, visionOS, and watchOS platforms (identified via CPE strings covering cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos). The root cause is an improper access control mechanism in the Keychain's permission validation logic, classified as an Information Disclosure vulnerability. Keychain stores highly sensitive data including passwords, authentication tokens, cryptographic keys, and payment information. The flaw allows circumvention of the sandbox and per-app isolation that normally restricts one application's access to another application's stored secrets, which is a violation of Apple's fundamental security model.

RemediationAI

Immediately update all affected Apple devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.4 or later, macOS to 15.7.5 (Sequoia), 14.8.5 (Sonoma), or 26.4 (Tahoe) or later, visionOS to 26.4 or later, and watchOS to 26.4 or later. Organizations should prioritize patching devices that store sensitive credentials or access corporate resources. Until updates can be deployed, implement additional mitigations by restricting physical and remote access to devices, disabling untrusted app installations, enforcing Mobile Device Management (MDM) policies to prevent installation of suspicious applications, and ensuring users do not grant excessive permissions to third-party apps. Consult Apple's official advisories at the links provided above for platform-specific patch deployment procedures and any interim guidance.