Apple operating systems CVE-2026-28974

Exploitation requires a malicious application to be installed on the target Apple device. While the CVSS vector indicates network-accessible, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N), the vendor description confirms an app must be present to trigger the vulnerability, creating a delivery barrier. The app need not be from untrusted sources - the vulnerability could potentially be triggered by malicious code within apps distributed through Apple's official App Store if the malicious payload evades app review processes. No special device configuration, user interaction beyond initial app installation, or elevated privileges are required once the malicious app is present. The vulnerability affects default configurations across all Apple platforms. The primary limiting factor is the requirement for app delivery and installation, which provides detection opportunities through endpoint security controls and Apple's Gatekeeper/App Review mechanisms.

Critical discrepancy exists between the vendor's stated impact and the CVSS assessment that security teams must understand. The vendor description claims 'denial-of-service' capability, but the CVSS vector (C:H/I:N/A:N) indicates HIGH confidentiality impact with NO availability impact - these are contradictory. The CVSS 7.5 score derives entirely from the confidentiality breach potential with network-accessible, low-complexity, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N). This represents a data exfiltration risk, not a DoS risk. Security teams should prioritize based on the confidentiality impact confirmed by CVSS analysis rather than the vendor's description. EPSS at 7th percentile suggests minimal observed exploitation activity in the wild, consistent with the vulnerability requiring malicious app installation (despite CVSS indicating network vector). The contradiction likely stems from CVSS scoring the network-reachable component while the vendor description focuses on the app-level trigger. Not listed in CISA KEV, indicating no confirmed active exploitation. Real-world risk is HIGH for environments with sensitive data on Apple devices, but exploitation requires app delivery, creating a detection opportunity.

An attacker develops a malicious application that exploits insufficient authorization checks in Apple's shared framework components. When installed on an unpatched device, the app executes network requests to access sensitive user data (contacts, photos, location history, or application data) without proper permission validation, bypassing Apple's privacy controls. The attacker exfiltrates this confidential information to remote servers without triggering visible permission prompts or security warnings. No public proof-of-concept exists at time of analysis.