What is the CVSS score of CVE-2026-28889?

CVE-2026-28889 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Xcode are affected by CVE-2026-28889?

Organizations using A permissions should be aware of moderate risk from CVE-2026-28889, a improper privilege management vulnerability rated CVSS 6.2.. A patch is available.

How to fix or mitigate CVE-2026-28889?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Xcode CVE-2026-28889

EUVD-2026-15167 MEDIUM

Improper Privilege Management (CWE-269)

2026-03-25 apple

GHSA-92fw-jwv6-qxx7

Privilege Escalation Xcode

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15167

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 6.2

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.

AnalysisAI

A permissions bypass vulnerability in Apple Xcode allows unprivileged applications to read arbitrary files with root-level privileges due to insufficient access controls. The vulnerability affects Xcode versions prior to 26.4 and could enable attackers to exfiltrate sensitive system files or configuration data. While no CVSS score or EPSS data is currently published, the ability to read arbitrary files as root represents a critical privilege escalation issue that warrants immediate patching.

Technical ContextAI

This vulnerability represents a permissions enforcement failure in Apple Xcode, the integrated development environment used for macOS and iOS development. The affected product is identified via CPE as cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*, covering all versions prior to the 26.4 patch release. While the specific CWE is not disclosed, the issue fundamentally relates to improper access control mechanisms—likely CWE-269 (Improper Access Control) or CWE-276 (Incorrect Default Permissions)—where Xcode's file access operations fail to properly validate or restrict permissions before granting root-level read access to arbitrary file system locations.

RemediationAI

Upgrade Apple Xcode to version 26.4 or later immediately to remediate this vulnerability. Users can obtain the patched version through the Mac App Store or by downloading directly from Apple's developer portal at https://support.apple.com/en-us/126801. As an interim measure before patching, restrict Xcode's execution environment using macOS security features such as System Integrity Protection (SIP) verification and restrict file system access through sandbox profiles or entitlements where possible. Additionally, audit any applications or build processes that depend on Xcode to ensure they are not running with elevated privileges unnecessarily.