What is the CVSS score of CVE-2026-28866?

CVE-2026-28866 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28866?

Organizations using This should be aware of moderate risk from CVE-2026-28866 rated CVSS 6.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-28866?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-28866

EUVD-2026-15145 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-03-25 apple

GHSA-8j28-3434-4q9h

Apple Information Disclosure macOS iOS

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,14.8.5,26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15145

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 6.2

DescriptionCVE.org

This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

A symlink validation vulnerability in Apple's iOS, iPadOS, and macOS operating systems allows malicious applications to bypass file system protections and access sensitive user data through improper handling of symbolic links. The vulnerability affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, and macOS Tahoe 26.4 and earlier. An attacker with the ability to install or execute an application on the affected system could leverage this weakness to read restricted files and access private user information without proper authorization.

Technical ContextAI

The vulnerability stems from inadequate validation of symbolic links (symlinks) at the operating system or application framework level, classified as an Information Disclosure weakness. Symbolic links are file system objects that point to other files or directories; improper validation allows applications to traverse beyond their intended sandbox boundaries. The affected products span Apple's entire consumer operating system lineup as indicated by the CPE strings cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos, affecting multiple major versions across iOS, iPadOS, and macOS platforms. The root cause involves insufficient checks when resolving or accessing symlinks, potentially allowing TOCTOU (Time-Of-Check-Time-Of-Use) race conditions or direct traversal to protected system files or other applications' private data stores.

RemediationAI

Immediately upgrade to iOS 18.7.7 or later, iPadOS 18.7.7 or later, iOS 26.4 or later, iPadOS 26.4 or later, macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later as applicable to your environment. Refer to Apple's security advisories (https://support.apple.com/en-us/126792 through 126796) for download links and validation procedures. Until patching is completed, restrict installation of untrusted applications, enforce Mobile Device Management (MDM) policies on iOS/iPadOS devices to prevent sideloading, and monitor system logs for suspicious file access patterns. Users should verify installed applications and remove any from untrusted sources, then enable automatic security updates to prevent regression.