What is the CVSS score of CVE-2026-28995?

CVE-2026-28995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple operating systems are affected by CVE-2026-28995?

CVE-2026-28995 is a sandbox escape vulnerability in Apple operating systems (iOS, macOS, iPadOS, tvOS, visionOS, watchOS) that allows low-privileged applications to escalate privileges and execute…. A patch is available.

How to fix or mitigate CVE-2026-28995?

Within 24 hours: Inventory all Apple devices in your environment and their current OS versions; notify device owners of urgent update availability. Within 7 days: Deploy patches across all affected platforms using Apple's released updates; prioritize devices handling sensitive data or with admin access. Within 30 days: Verify patch deployment completion through MDM/device management tools; audit app installation policies to restrict sideloading on unpatched devices during transition period.

Apple operating systems CVE-2026-28995

EUVD-2026-29288 HIGH

Improper Privilege Management (CWE-269)

2026-05-11 apple

GHSA-r645-jpx2-wq58

Privilege Escalation Apple

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 14:29 vuln.today

CVSS changed

May 12, 2026 - 14:22 NVD

8.8 (HIGH)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 20:08 nvd

HIGH 8.8

DescriptionCVE.org

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox.

AnalysisAI

Sandbox escape vulnerability in Apple operating systems allows malicious apps with low privileges to break out of application sandbox and execute code with elevated privileges on the host system. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS across multiple versions. Apple has released patches for all affected platforms. EPSS score of 0.02% (7th percentile) indicates low probability of mass exploitation in the wild, though the CVSS 8.8 score reflects significant potential impact if successfully weaponized. No active exploitation confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from a logic flaw (CWE-269: Improper Privilege Management) in Apple's application sandbox enforcement mechanism, which is a fundamental security boundary across all Apple platforms. The sandbox is a mandatory access control framework that restricts what system resources and APIs an application can access, isolating apps from each other and from critical OS components. The logic issue allowed malicious applications to bypass these restrictions through unspecified means. Apple's fix involved improved restrictions in the sandbox policy enforcement, suggesting the flaw was in how sandbox entitlements or capabilities were evaluated. The vulnerability affects the core operating system security architecture rather than a specific application or service, making it platform-wide across Apple's ecosystem including iOS/iPadOS (both legacy 18.x and current 26.x branches), macOS Tahoe 26.x, tvOS, visionOS, and watchOS.

RemediationAI

Update to patched versions released by Apple: iOS and iPadOS 18.7.9 or 26.5 (depending on device compatibility), macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5. Updates are available through standard system update mechanisms (Settings → General → Software Update on iOS/iPadOS, System Settings → General → Software Update on macOS). No workarounds are available for this vulnerability as it affects core OS sandbox enforcement. For organizations unable to immediately patch, implement compensating controls including strict application whitelisting through Mobile Device Management (MDM) policies to prevent installation of untrusted applications, disable developer mode and sideloading capabilities where enabled, monitor for suspicious application behavior through endpoint detection tools, and restrict physical device access. Note that these controls do not eliminate the vulnerability but reduce attack surface by limiting malicious app installation vectors. Enterprise environments should prioritize patching user-facing devices (iOS/iPadOS) and administrative workstations (macOS) first, as these represent highest-risk attack surfaces.