EUVD-2026-15095Vulnerability Assessment
| Impact | Without an assigned CVSS score or EPSS probability data, risk assessment relies on the vulnerability's inherent characteristics and threat model. A sandbox escape is inherently critical because it eliminates the primary isolation mechanism protecting the operating system from malicious applications—this is a technical impact of maximum severity (full system compromise potential). The attack vector is likely local (requires a malicious app installed on the system), and exploitation complexity is unknown but may range from low (trivial logic flaw) to moderate (race condition or specific configuration requirement). The absence of public POC or KEV listing suggests either recent disclosure or active embargo, but the Apple security advisory indicates this is being tracked formally. Given that sandbox escapes are frequently targeted by threat actors and can enable advanced persistent threats, this should be treated as a critical priority despite missing formal scores. |
| Exploit ScenarioDerived | An attacker distributes a malicious application through unofficial channels or social engineering. Once installed and executed on a target macOS system, the application exploits the sandbox logic flaw to break out of its restricted environment and gain access to sensitive user files, system processes, and potentially execute arbitrary code with user or elevated privileges. This could lead to data exfiltration, lateral movement, or persistent compromise of the affected macOS system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A logic issue in macOS Tahoe allows a malicious application to escape its sandbox and execute code outside of the restricted security boundary. This vulnerability affects macOS versions prior to 26.4 and represents a critical sandbox bypass that could enable arbitrary code execution with elevated privileges. While no CVSS score or active exploitation data is currently available, the sandbox escape capability makes this a high-priority patch for all affected macOS users.
RemediationAI
Immediately upgrade to macOS Tahoe 26.4 or later, which contains the improved sandbox restriction logic to address this vulnerability. Users should navigate to System Settings > General > Software Update and install the latest available macOS version. Until patching is completed, temporarily mitigate risk by disabling installation of untrusted applications, restricting admin account usage, and using additional security tools such as third-party endpoint detection and response (EDR) solutions. Review the official Apple security advisory at https://support.apple.com/en-us/126794 for detailed patching instructions and any known compatibility issues.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in a logic flaw within macOS's application sandbox enforcement mechanism, a core security feature that restricts application capabilities and file system access. macOS implements a mandatory access control (MAC) framework that prevents applications from accessing sensitive system resources and user data unless explicitly granted permission. This vulnerability allows a malicious application to circumvent these restrictions through improved logic handling, affecting the core operating system (cpe:2.3:a:apple:macos). The root cause appears to be improper validation or enforcement of sandbox boundaries rather than a memory corruption issue, suggesting the flaw may involve authorization decisions, capability delegation, or privilege escalation logic.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to break out of its sandbox.
Executive ViewAI
Organizations using A logic should be aware of moderate risk from CVE-2026-28826 rated CVSS 4.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB