EUVD-2026-15137
GHSA-pwfm-qvvq-w8j5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The risk assessment is constrained by missing CVSS vector and EPSS data, which limits quantitative analysis. However, several qualitative factors suggest moderate real-world risk: the vulnerability is classified as Information Disclosure rather than remote code execution, indicating lower attack severity; there is no indication of active exploitation in the wild or public proof-of-concept code; and the attack surface requires either a malicious application running on the affected system or privileged access to log files. The fact that Apple issued patches for three macOS versions (Sequoia, Sonoma, and Tahoe) indicates the company treats this as a priority fix, though the delayed patch timeline and lack of emergency advisory suggest this is not a critical zero-day. The real-world priority depends on whether sensitive data is actually stored in logs in typical deployments and whether users store sensitive credentials or personal information in contexts that would be logged. |
| Exploit ScenarioDerived | An attacker installs a malicious application on a macOS system with user permission; once running, the application queries system log files to extract sensitive information that was supposed to be redacted, such as API tokens, user authentication credentials, or personal identifiers logged by system components or other applications. Alternatively, a local attacker with access to a compromised user account reads the log files directly and extracts the unredacted sensitive data that the privacy mechanism failed to obscure. The attack requires no special privileges or sophisticated techniques beyond file system access, making it practical for attackers who have already gained a foothold on the system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
This vulnerability is a privacy issue in Apple macOS where improved private data redaction for log entries was not properly implemented, allowing applications to potentially access user-sensitive data that should have been redacted. The vulnerability affects macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4, with no public indicators of active exploitation or proof-of-concept code. While CVSS and EPSS scores are unavailable, the nature of the issue suggests moderate real-world risk due to its reliance on application-level exploitation requiring user interaction or system access.
RemediationAI
Users should immediately update their macOS systems to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Updates can be applied through System Preferences > Software Update or by visiting https://support.apple.com/en-us/126794 (Sequoia), https://support.apple.com/en-us/126795 (Sonoma), and https://support.apple.com/en-us/126796 (Tahoe). Until patching is feasible, organizations should restrict access to system log files through proper file permissions and access control lists, limit which applications are granted logging permissions, and avoid storing sensitive data (credentials, PII) in contexts that trigger system logging. For development teams, audit applications to ensure they do not rely on log file contents for sensitive information recovery.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Apple's macOS logging infrastructure (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), which is responsible for generating and storing system and application log entries. The root cause appears to fall under Information Disclosure (CWE category), specifically inadequate data sanitization in log redaction mechanisms. When applications generate logs containing sensitive user information such as authentication tokens, personal identifiers, or private data, the operating system is expected to redact these values before storing them in accessible log files. The flaw in the redaction process allows applications to bypass or circumvent this privacy protection, potentially exposing sensitive data in plaintext within log entries that may be accessible to other applications or users.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Executive ViewAI
Organizations using A privacy should be aware of moderate risk from CVE-2026-28862, a improper access control vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.893 and Application versions prior to
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Exploit-DB