What is the CVSS score of CVE-2026-28865?

CVE-2026-28865 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28865?

CVE-2026-28865 affects Apple's core authentication mechanisms across all major platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), enabling network-positioned attackers to intercept encrypted…. A patch is available.

How to fix or mitigate CVE-2026-28865?

Within 24 hours: Inventory all Apple devices in production (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and identify those handling sensitive communications. Within 7 days: Apply vendor-released patches to all affected Apple operating systems as specified in the official security advisory. Within 30 days: Conduct network segmentation review to isolate critical Apple devices and implement network access controls limiting device communication to trusted networks only.

macOS CVE-2026-28865

EUVD-2026-15143 HIGH

Improper Authorization (CWE-285)

2026-03-25 apple

Apple Authentication Bypass macOS iOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15143

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker in a privileged network position may be able to intercept network traffic.

AnalysisAI

Improper state management in Apple's authentication mechanisms across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS allows attackers positioned on a network to intercept and potentially manipulate encrypted traffic. An attacker with privileged network access can exploit this vulnerability to conduct man-in-the-middle attacks without user interaction, compromising the confidentiality of communications. No patch is currently available for this high-severity flaw.

Technical ContextAI

The vulnerability is rooted in improper state management within Apple's authentication mechanisms across multiple operating system platforms. The affected products span iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), macOS (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), tvOS (cpe:2.3:a:apple:tvos:*:*:*:*:*:*:*:*), visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*), and watchOS (cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*). The root cause relates to insufficient validation or tracking of authentication state transitions, which could be classified under CWE categories related to authentication bypass or state management flaws. Attackers exploiting this issue can intercept network traffic due to weakened authentication state enforcement, potentially allowing man-in-the-middle scenarios where encrypted communications are downgraded or authentication tokens are compromised.

RemediationAI

Immediately upgrade affected devices to the patched versions: iOS and iPadOS to 18.7.7 or 26.4, macOS to Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4, and tvOS, visionOS, and watchOS to 26.4 or later. See the Apple security advisories at the URLs listed above for platform-specific instructions. As interim measures for organizations unable to patch immediately, enforce network segmentation to restrict device communication to trusted networks only, implement network intrusion detection systems (IDS) to monitor for suspicious authentication state changes or unexpected network traffic patterns, utilize VPN on untrusted networks to protect against privileged network-based interception, and disable non-essential network services on affected devices. Additionally, monitor for any suspicious account activity or unauthorized access attempts that may indicate prior exploitation.