What is the CVSS score of CVE-2026-28876?

CVE-2026-28876 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28876?

CVE-2026-28876 is a high-severity path validation flaw affecting iOS, iPadOS, macOS, and visionOS that enables malicious applications to circumvent directory access controls and exfiltrate sensitive…. A patch is available.

How to fix or mitigate CVE-2026-28876?

Within 24 hours: Identify all Apple devices (iOS, iPadOS, macOS, visionOS) in your environment and document current OS versions. Within 7 days: Apply vendor-released patches to all affected devices-iOS, iPadOS, macOS, and visionOS systems to versions containing the fix; consult Apple security advisories for exact patch versions. Within 30 days: Audit app installation policies to restrict sideloaded applications and enforce Mobile Device Management (MDM) controls that limit third-party app sources.

iOS CVE-2026-28876

EUVD-2026-15153 HIGH

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-xp9f-jj97-j8gx

Authentication Bypass Apple iOS macOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15153

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

HIGH 7.5

DescriptionCVE.org

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to access sensitive user data.

AnalysisAI

Improper path validation in Apple's operating systems (iOS, iPadOS, macOS, and visionOS) allows applications to bypass directory access restrictions and read sensitive user data without user interaction. An attacker with a malicious app could exploit this parsing weakness to access confidential information across affected Apple devices. No patch is currently available, though Apple has released fixed versions across its product line.

Technical ContextAI

The vulnerability stems from insufficient validation of file system directory paths during parsing operations within Apple's operating system kernel or system libraries responsible for file access control. This represents a classic path traversal or insufficient input validation issue (likely related to CWE-22 or similar path-based weaknesses). The affected CPE identifiers include apple:ios_and_ipados, apple:macos, and apple:visionos across multiple versions, indicating the flaw exists at a fundamental level affecting all applications on these platforms that rely on standard file system access mechanisms. The parsing defect allows malicious or compromised applications to manipulate path constructs to bypass intended access control boundaries, potentially accessing files and directories outside their designated sandbox or entitlement scope.

RemediationAI

Immediately upgrade all affected Apple devices to the patched versions: iOS and iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, or visionOS 26.4. Enable automatic security updates via Settings > General > Software Update > Automatic Updates on iOS/iPadOS, System Settings > General > Software Update on macOS, and equivalent settings on visionOS to ensure continuous protection. Until patching is complete, restrict installation of untrusted applications, review application permissions via Settings, and monitor system logs for suspicious file access patterns. For enterprise environments, prioritize mobile device management (MDM) enforcement of immediate updates and consider restricting app installation to curated application catalogs until patch deployment is complete across all devices.