EUVD-2026-15145
GHSA-8j28-3434-4q9h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Impact | While the CVSS score and vector are not numerically disclosed in this advisory, the vulnerability's classification as Information Disclosure combined with Apple's broad patch deployment across five separate security advisories indicates moderate-to-high severity within Apple's ecosystem. The lack of a published CVSS vector and EPSS score prevents quantitative exploitation probability assessment, but the fact that Apple addressed this with improved validation suggests a genuine exploitability concern that required engineering changes rather than configuration updates. The vulnerability targets sandboxed application contexts, meaning exploitation requires either a malicious application installation or privilege escalation; however, given iOS and macOS app store distribution models, a compromised or malicious app poses a credible threat vector. The information disclosure impact is significant because user data sensitivity (photos, messages, location, credentials) on these platforms is high, making even limited unauthorized access a material privacy concern. |
| Exploit ScenarioDerived | An attacker distributes a seemingly legitimate application through the Apple App Store or via sideloading mechanisms that contains code exploiting the symlink validation flaw. Once installed and granted basic permissions, the malicious app uses symlink traversal to access the user's private photo library, message database, or credential storage that would normally be protected by sandboxing. For example, the app could create or follow symlinks pointing to /var/mobile/Library/SMS/ (messages) or other restricted directories, exfiltrating sensitive communications or personal data without the user's knowledge. The attack requires no special entitlements or user interaction beyond initial installation, making it a practical threat for targeted users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A symlink validation vulnerability in Apple's iOS, iPadOS, and macOS operating systems allows malicious applications to bypass file system protections and access sensitive user data through improper handling of symbolic links. The vulnerability affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, and macOS Tahoe 26.4 and earlier. An attacker with the ability to install or execute an application on the affected system could leverage this weakness to read restricted files and access private user information without proper authorization.
RemediationAI
Immediately upgrade to iOS 18.7.7 or later, iPadOS 18.7.7 or later, iOS 26.4 or later, iPadOS 26.4 or later, macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later as applicable to your environment. Refer to Apple's security advisories (https://support.apple.com/en-us/126792 through 126796) for download links and validation procedures. Until patching is completed, restrict installation of untrusted applications, enforce Mobile Device Management (MDM) policies on iOS/iPadOS devices to prevent sideloading, and monitor system logs for suspicious file access patterns. Users should verify installed applications and remove any from untrusted sources, then enable automatic security updates to prevent regression.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from inadequate validation of symbolic links (symlinks) at the operating system or application framework level, classified as an Information Disclosure weakness. Symbolic links are file system objects that point to other files or directories; improper validation allows applications to traverse beyond their intended sandbox boundaries. The affected products span Apple's entire consumer operating system lineup as indicated by the CPE strings cpe:2.3:a:apple:ios_and_ipados and cpe:2.3:a:apple:macos, affecting multiple major versions across iOS, iPadOS, and macOS platforms. The root cause involves insufficient checks when resolving or accessing symlinks, potentially allowing TOCTOU (Time-Of-Check-Time-Of-Use) race conditions or direct traversal to protected system files or other applications' private data stores.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Executive ViewAI
Organizations using This should be aware of moderate risk from CVE-2026-28866 rated CVSS 6.2. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Exploit-DB