What is the CVSS score of EUVD-2026-15146?

EUVD-2026-15146 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by EUVD-2026-15146?

Organizations using This should be aware of moderate risk from CVE-2026-28867 rated CVSS 6.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-15146?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS EUVD-2026-15146

| CVE-2026-28867 MEDIUM

2026-03-25 apple

GHSA-j35r-rmh5-j299

Information Disclosure Apple iOS macOS

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,18.7.7,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15146

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 6.2

DescriptionCVE.org

This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to leak sensitive kernel state.

AnalysisAI

A kernel state information disclosure vulnerability exists across Apple's entire platform ecosystem that allows a malicious application to leak sensitive kernel memory without requiring elevated privileges. The vulnerability affects iOS and iPadOS versions prior to 18.7.7 and 26.4, macOS Sequoia prior to 15.7.5, macOS Tahoe 26.4, and tvOS, visionOS, and watchOS 26.4. An attacker can craft a specially designed app that exploits improper authentication mechanisms to access protected kernel state, potentially exposing cryptographic keys, memory addresses, or other sensitive operating system internals that could be chained with other vulnerabilities.

Technical ContextAI

This vulnerability is classified as an Information Disclosure issue (CWE not explicitly provided but implied to be related to improper authentication and access control in kernel-level operations). The affected technologies span Apple's entire platform architecture including iOS/iPadOS (cpe:2.3:a:apple:ios_and_ipados), macOS (cpe:2.3:a:apple:macos), tvOS (cpe:2.3:a:apple:tvos), visionOS (cpe:2.3:a:apple:visionos), and watchOS (cpe:2.3:a:apple:watchos). The root cause appears to involve insufficient authentication validation when user-space applications attempt to access kernel state or memory regions that should be restricted. Rather than enforcing proper permission boundaries, the kernel failed to properly authenticate requests from third-party applications, allowing arbitrary apps to read sensitive kernel data structures.

RemediationAI

Update all Apple devices to the patched versions immediately: iOS and iPadOS to version 18.7.7 or 26.4 or later, macOS Sequoia to version 15.7.5 or later, macOS Tahoe to 26.4 or later, tvOS to 26.4 or later, visionOS to 26.4 or later, and watchOS to 26.4 or later. Consult the specific support articles (https://support.apple.com/en-us/126792-126799) for your device platform to confirm the exact update path. For organizations unable to immediately deploy patches, enforce strict app vetting policies through Mobile Device Management (MDM) to prevent installation of untrusted applications, and monitor for suspicious app behavior. Consider restricting installation of third-party applications from untrusted developers until patches can be deployed, as the vulnerability requires local app execution to exploit.