What is the CVSS score of EUVD-2026-15097?

EUVD-2026-15097 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by EUVD-2026-15097?

A critical sandbox escape vulnerability in macOS (Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.4) allows locally-installed malicious applications to break out of security restrictions and gain full system…. A patch is available.

How to fix or mitigate EUVD-2026-15097?

24 hours: Audit and document all macOS devices running Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 in your environment; immediately restrict user ability to install third-party applications until patched. 7 days: Monitor CISA KEV catalog and Apple security advisories for patch release confirmation; prepare update deployment plan. 30 days: Apply vendor-released patch to all affected macOS systems as soon as Apple releases the fix; implement application allowlist controls to prevent execution of untrusted binaries.

macOS EUVD-2026-15097

| CVE-2026-28827 CRITICAL

Path Traversal (CWE-22)

2026-03-25 apple

Apple Path Traversal macOS

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:49 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,26.4,14.8.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15097

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

CRITICAL 9.3

DescriptionCVE.org

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.

AnalysisAI

Improper path validation in macOS (Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4) allows sandboxed applications to escape their sandbox restrictions through directory path traversal. A local attacker with the ability to run malicious apps can exploit this weakness to execute code outside sandbox boundaries with full system privileges. No patch is currently available for this critical vulnerability.

Technical ContextAI

The vulnerability stems from inadequate path validation logic in the macOS kernel or system frameworks responsible for enforcing sandbox boundaries. Path parsing operations are fundamental to sandbox policy enforcement, which uses directory-level access controls to restrict application capabilities. The flaw likely involves insufficient canonicalization or validation of symbolic links, relative path traversal sequences (../, .), or other path manipulation techniques that could deceive the sandbox validation logic. The affected products are identified via CPE (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability affects the macOS operating system across multiple versions rather than a discrete application. The root cause aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) or similar path traversal weaknesses, where insufficient input validation allows attackers to access resources outside intended boundaries.

RemediationAI

Immediately upgrade to macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4 or later, depending on your current operating system version. Visit Apple's security advisory pages (https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, https://support.apple.com/en-us/126796) to confirm patch availability and download options. For users unable to patch immediately, restrict the execution and permissions of third-party applications by enforcing System Integrity Protection (SIP) and reviewing sandbox entitlements of installed applications via the security tools in macOS System Preferences. Monitor system logs for suspicious cross-process activity or file access patterns that could indicate sandbox escape attempts. After patching, verify that all security updates have been applied by checking System Settings > General > About and confirming the OS build number matches the patched version.