Apple operating systems CVE-2026-28995

Exploitation requires a malicious application to be installed and executed on the target Apple device. The attacker needs low-privilege local access (PR:L in CVSS vector), meaning the malicious code must run within an application context on the device. On iOS and iPadOS, this typically requires bypassing App Store security review through targeted distribution (enterprise certificates, TestFlight, developer profiles) or social engineering users to install apps from untrusted sources. On macOS, installation barriers are lower with standard user permissions sufficient to install applications. No special device configuration, jailbreak, or elevated privileges required prior to exploitation. Attack complexity is low (AC:L) indicating reliable exploitation once the malicious app is running. User interaction is not required (UI:N) after initial app installation and launch. The vulnerability affects default configurations of all listed Apple operating systems.

Real-world risk assessment reveals moderate threat despite high CVSS 8.8 score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates local attack requiring low-privilege authenticated access but no user interaction, with scope change allowing impact beyond the vulnerable component. However, EPSS exploitation probability of 0.02% (7th percentile) suggests security researchers and threat actors currently assess this as low priority for widespread exploitation. The attack requires prior code execution on the device (malicious app must already be installed), which on iOS/iPadOS platforms requires bypassing App Store review processes or tricking users into sideloading. No CISA KEV listing and no public exploit identified at time of analysis. The S:C (Changed scope) metric is critical - successful exploitation allows breaking fundamental OS security boundaries, potentially accessing user data across all apps, keychain credentials, or system services. Primary risk scenarios include targeted attacks against high-value individuals who might install trojanized applications, or post-compromise privilege escalation in multi-stage attacks. For enterprise environments with MDM-managed devices and restricted app installation, risk is significantly lower than CVSS suggests. Patch availability across all platforms within coordinated release reduces window of exposure.

An attacker distributes a seemingly legitimate application through phishing, social engineering, or a compromised third-party app store that contains exploit code for this sandbox escape vulnerability. Once the user installs and launches the malicious app, it exploits the logic flaw in sandbox restrictions to break containment, gaining access to sensitive data from other applications (messages, photos, browser cookies, credential keychains), installing persistent backdoors outside the sandbox, or exfiltrating enterprise data from managed applications. The attack requires no further user interaction after initial app launch. No public exploit code identified at time of analysis.