EUVD-2026-15171
GHSA-cpwg-vrfx-x8g6
Vulnerability Assessment
| Impact | While specific CVSS and EPSS scores are unavailable, the real-world risk is moderate to high based on available signals. The vulnerability is rooted in a fundamental security boundary (file system permissions), and Apple's remediation strategy of removing vulnerable code suggests a logic flaw rather than a complex exploitation requirement. The absence of a CVSS vector prevents calculation of attack complexity and privilege requirements, but the fact that patched versions exist for three concurrent macOS releases indicates Apple treated this as a priority issue. No KEV status or public POC is available, suggesting the vulnerability was discovered through internal review rather than active exploitation. Organizations running unpatched Sequoia, Sonoma, or Tahoe systems face risk from both malicious applications and lateral movement attacks where a compromised process could elevate its file system access. |
| Exploit ScenarioDerived | An attacker distributes a seemingly benign application through third-party app stores or social engineering. Once installed with user consent, the application leverages the permissions bypass to write malicious code or configuration files to protected system directories such as /Library/LaunchDaemons, establishing persistence across reboots without requiring elevated privileges. The vulnerability's classification as a permissions issue suggests the attack does not require complex exploitation techniques, making it accessible to commodity malware once discovered post-patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A permissions enforcement vulnerability in macOS allows applications to bypass file system protections and modify protected system files or directories through inadequate access controls. This affects macOS Sequoia (before 15.7.5), macOS Sonoma (before 14.8.5), and macOS Tahoe (before 26.4). Apple has addressed the issue by removing vulnerable code, and no active exploitation or proof-of-concept has been publicly disclosed at this time.
RemediationAI
Immediately update affected macOS systems to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. These updates are available through System Preferences > General > Software Update or can be downloaded directly from Apple's support pages (https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, https://support.apple.com/en-us/126796). Until patching is completed, enforce application sandboxing policies, disable execution of untrusted applications, and restrict user account privileges to prevent installation of potentially malicious software that could exploit this permissions bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Apple's macOS operating system file system permissions architecture, affecting multiple major versions identified via CPE (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*). The root cause is classified as a permissions issue (CWE category: improper access control or authorization), where the kernel or file system driver failed to properly validate or enforce access control lists (ACLs) and file system protections when third-party applications attempted filesystem operations. This represents a failure in the privilege separation model that ordinarily prevents unprivileged applications from modifying protected system directories such as /System, /Library, or /Applications at the kernel level.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system.
Executive ViewAI
Organizations using A permissions should be aware of moderate risk from CVE-2026-28892 rated CVSS 5.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB