What is the CVSS score of CVE-2026-28880?

CVE-2026-28880 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28880?

Organizations using A permissions should be aware of notable risk from CVE-2026-28880, a improper access control vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-28880?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-28880

EUVD-2026-15161 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-wh29-fhm6-hqrh

Authentication Bypass Apple iOS macOS

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15161

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 6.5

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps.

AnalysisAI

A permissions enforcement vulnerability in Apple operating systems allows unauthorized enumeration of installed applications on a user's device. This information disclosure issue affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier. An attacker with the ability to execute code as an installed application could enumerate the complete list of user-installed applications without explicit user permission, enabling targeted attacks, privacy violations, and device profiling.

Technical ContextAI

The vulnerability stems from insufficient permission validation in Apple's application enumeration APIs across multiple operating systems. The root cause involves inadequate access control checks that fail to properly restrict an application's ability to query the system's installed application database. This affects the following products as identified through CPE matching: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:visionos. The vulnerability is classified as an Information Disclosure issue (CWE category related to improper restriction of rendered UI layers or unintended content exposure). The flaw exists in the permission boundary enforcement mechanisms that should isolate applications from accessing system-wide application inventory without explicit sandbox exceptions or user grants.

RemediationAI

Users and administrators should immediately update affected devices to the patched versions: iOS and iPadOS 18.7.7 or later, iOS and iPadOS 26.4 or later, macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, macOS Tahoe 26.4 or later, and visionOS 26.4 or later. For iOS/iPadOS, enable automatic updates via Settings > General > Software Update > Automatic Updates. For macOS, open System Settings > General > Software Update and apply updates immediately. Additionally, review installed applications for suspicious or unnecessary apps that may have been installed by users unaware of enumeration risks. Organizations should enforce mobile device management (MDM) policies to mandate prompt patching and restrict sideloading of untrusted applications. Users can mitigate interim risk by avoiding installation of applications from untrusted sources until patches are deployed. Refer to Apple's official security advisories at https://support.apple.com/en-us/126792 through 126799 for version-specific patch details.