What is the CVSS score of CVE-2026-28976?

CVE-2026-28976 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apple macOS are affected by CVE-2026-28976?

Apple macOS versions prior to Tahoe 26.5 contain a local privilege escalation vulnerability that allows malicious or compromised applications to obtain root access on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-28976?

Within 24 hours, complete an inventory of all macOS systems, identify which devices are running versions prior to Tahoe 26.5, and download the Tahoe 26.5 patch for testing. Within 7 days, deploy the macOS Tahoe 26.5 patch to high-priority systems including servers, administrative workstations, and devices processing sensitive data. Within 30 days, ensure all remaining macOS systems have been updated to Tahoe 26.5 or confirmed to already be on a patched version.

Apple macOS CVE-2026-28976

EUVD-2026-29275 HIGH

Information Exposure (CWE-200)

2026-05-11 apple

GHSA-78p6-jjm8-c38v

Information Disclosure Apple

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.8 HIGH

Description requires a locally running app (AV:L, PR:L) and yields root, i.e., full C/I/A compromise; low complexity, no user interaction beyond running the app.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:37 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

7.5 (HIGH)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

HIGH 7.5

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be able to gain root privileges.

AnalysisAI

Local privilege escalation in Apple macOS (all versions prior to Tahoe 26.5) allows a malicious or compromised application to gain root privileges by abusing an information-leakage weakness that Apple addressed through additional validation. Reported internally by Apple with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and the flaw is not on the CISA KEV list. A vendor-released patch is available in macOS Tahoe 26.5.

Technical ContextAI

The affected component is Apple's macOS operating system (cpe:2.3:a:apple:macos). The root-cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): a system component disclosed data it should have kept protected, and Apple's fix was to add extra validation before that data is returned. Although filed as information disclosure, Apple's advisory headline states the practical impact is that 'an app may be able to gain root privileges,' indicating the leaked information (e.g., sensitive state, memory contents, or a protected identifier/path) can be leveraged by an unprivileged local application to escalate to root on the host.

RemediationAI

Vendor-released patch: macOS Tahoe 26.5 - upgrade all Macs to 26.5 or later, which resolves the issue via additional validation per Apple's advisory (https://support.apple.com/en-us/127115). No standalone workaround is published; because exploitation requires a malicious or compromised local application, the most effective compensating control until patching is to restrict installation and execution of untrusted apps (enforce Gatekeeper, allow only notarized/App Store or MDM-approved software, and remove local admin rights where feasible), accepting the trade-off of reduced user flexibility in installing software. As a detective control, monitor for unexpected root-owned processes spawned by user applications.