EUVD-2026-15111
GHSA-7j45-7q44-56w8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are not provided, the real-world risk is significant based on available signals. The vulnerability is a sandbox escape, which represents a high-impact technical outcome—an attacker would gain capabilities far beyond what a sandboxed application should have access to. The fact that Apple issued patches across three concurrent macOS versions (Sequoia, Sonoma, and Tahoe) indicates they prioritized this as a critical issue. No KEV (Known Exploited Vulnerabilities) catalog status or public POC is indicated, suggesting this may not yet be actively exploited in the wild, which reduces immediate tactical risk. However, the sandbox escape nature means the threat model is severe—any user running an older macOS version and installing a malicious application could be compromised. The patch availability across all three versions is positive, making remediation straightforward for organizations that maintain current OS versions. |
| Exploit ScenarioDerived | An attacker creates a malicious application and distributes it through alternative app stores, phishing campaigns, or bundled with legitimate software. When a user on a vulnerable macOS system runs this application, the sandbox escape vulnerability allows the malicious app to exceed its intended permissions, accessing sensitive files (browsing history, passwords, documents), launching privilege escalation attacks, installing persistent malware, or exfiltrating private data. The attack requires user action (downloading and running an app) but exploits a fundamental OS security mechanism rather than requiring advanced technical complexity from the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A sandbox escape vulnerability in macOS allows malicious applications to break out of their sandbox restrictions through a permissions issue. This affects macOS Sequoia (versions prior to 15.7.5), macOS Sonoma (versions prior to 14.8.5), and macOS Tahoe (versions prior to 26.4). An attacker who distributes a malicious app could potentially gain unauthorized access to system resources and user data that should be protected by the sandbox security boundary.
RemediationAI
Immediately update to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Updates are available through System Settings > General > Software Update. For enterprise environments, deploy these updates through Mobile Device Management (MDM) systems or Mac updates via your standard patch management process. Until patching is completed, restrict installation of applications from untrusted sources and disable installation of apps from sources other than the App Store where possible, as the App Store applies additional security review. Users should also review installed applications and remove any that are not from trusted publishers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the macOS application sandbox mechanism, which is a core security boundary that isolates applications from the broader system and from one another. The issue is classified as a permissions enforcement failure rather than a code execution vulnerability itself. Apple's response involved implementing additional sandbox restrictions, indicating that the existing permission validation logic was insufficient to prevent unauthorized capability escalation. The affected CPE range (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) encompasses all macOS variants, though specific versions have been patched. This falls under authorization and access control weaknesses, representing a failure in the enforcement of sandbox isolation policies across multiple macOS releases.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.
Executive ViewAI
Organizations using A permissions should be aware of moderate risk from CVE-2026-28838 rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB