What is the CVSS score of EUVD-2026-15095?

EUVD-2026-15095 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by EUVD-2026-15095?

Organizations using A logic should be aware of moderate risk from CVE-2026-28826 rated CVSS 4.0. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-15095?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Apple EUVD-2026-15095

| CVE-2026-28826 MEDIUM

2026-03-25 apple

Apple Information Disclosure

4.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15095

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 4.0

DescriptionCVE.org

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.4. A malicious app may be able to break out of its sandbox.

AnalysisAI

A logic issue in macOS Tahoe allows a malicious application to escape its sandbox and execute code outside of the restricted security boundary. This vulnerability affects macOS versions prior to 26.4 and represents a critical sandbox bypass that could enable arbitrary code execution with elevated privileges. While no CVSS score or active exploitation data is currently available, the sandbox escape capability makes this a high-priority patch for all affected macOS users.

Technical ContextAI

The vulnerability is rooted in a logic flaw within macOS's application sandbox enforcement mechanism, a core security feature that restricts application capabilities and file system access. macOS implements a mandatory access control (MAC) framework that prevents applications from accessing sensitive system resources and user data unless explicitly granted permission. This vulnerability allows a malicious application to circumvent these restrictions through improved logic handling, affecting the core operating system (cpe:2.3:a:apple:macos). The root cause appears to be improper validation or enforcement of sandbox boundaries rather than a memory corruption issue, suggesting the flaw may involve authorization decisions, capability delegation, or privilege escalation logic.

RemediationAI

Immediately upgrade to macOS Tahoe 26.4 or later, which contains the improved sandbox restriction logic to address this vulnerability. Users should navigate to System Settings > General > Software Update and install the latest available macOS version. Until patching is completed, temporarily mitigate risk by disabling installation of untrusted applications, restricting admin account usage, and using additional security tools such as third-party endpoint detection and response (EDR) solutions. Review the official Apple security advisory at https://support.apple.com/en-us/126794 for detailed patching instructions and any known compatibility issues.