What is the CVSS score of CVE-2026-28894?

CVE-2026-28894 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of macOS are affected by CVE-2026-28894?

CVE-2026-28894 is a high-severity denial-of-service vulnerability affecting Apple's iOS, iPadOS, and macOS platforms that allows remote attackers to crash devices and services through malformed…. A patch is available.

How to fix or mitigate CVE-2026-28894?

Within 24 hours: Inventory all Apple devices (iOS, iPadOS, macOS) in your environment and document current OS versions against affected versions (iOS ≤26.4, iPadOS ≤26.4, macOS Sequoia ≤15.7.4, Sonoma ≤14.8.4, Tahoe ≤26.3). Within 7 days: Check Apple security advisories for patch release dates and develop a staged deployment plan; implement network-level DoS detection to identify exploitation attempts. Within 30 days: Deploy available vendor patches to all affected systems as soon as Apple releases them; prioritize business-critical devices first.

macOS CVE-2026-28894

EUVD-2026-15175 HIGH

Improper Input Validation (CWE-20)

2026-03-25 apple

Apple Information Disclosure macOS iOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,14.8.5,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15175

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

HIGH 7.5

DescriptionCVE.org

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A remote attacker may be able to cause a denial-of-service.

AnalysisAI

Remote attackers can trigger denial-of-service conditions against multiple Apple operating systems (iOS, iPadOS, macOS variants) through network requests that bypass insufficient input validation. The vulnerability affects iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.4 and earlier, macOS Sonoma 14.8.4 and earlier, and macOS Tahoe 26.3 and earlier. No patch is currently available for this high-severity vulnerability with a 7.5 CVSS score.

Technical ContextAI

This vulnerability involves an input validation flaw in Apple's operating system kernel or core system libraries, likely affecting network protocol handling or file processing subsystems that process untrusted remote input. The root cause class appears to be improper input validation (related to CWE categories such as CWE-20: Improper Input Validation), where insufficient bounds checking or sanitization allows malformed or oversized input to trigger resource exhaustion or crash conditions. The affected CPE entries (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) indicate this is a platform-level vulnerability affecting the operating system itself rather than a discrete application, making it a systemic issue requiring vendor-level remediation across multiple major OS releases.

RemediationAI

Update to iOS 26.4 or later on all iPhone and iPad devices, update to macOS Sequoia 15.7.5 or later on compatible Mac computers, update to macOS Sonoma 14.8.5 or later on older Mac systems, and update to macOS Tahoe 26.4 or later where applicable. Users should prioritize applying these updates immediately via Settings > General > Software Update on iOS/iPadOS or System Settings > General > Software Update on macOS. Organizations managing large device fleets should use Mobile Device Management (MDM) solutions to enforce automatic updates and monitor compliance. Until patches can be deployed, limit network exposure of vulnerable systems where possible and monitor system logs for unexpected resource exhaustion or service disruptions that might indicate exploitation attempts. For additional details and to verify patch status, consult the Apple security advisories at https://support.apple.com/en-us/126792, https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796.