What is the CVSS score of EUVD-2026-15163?

EUVD-2026-15163 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by EUVD-2026-15163?

Organizations using A privacy should be aware of moderate risk from CVE-2026-28881 rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-15163?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS EUVD-2026-15163

| CVE-2026-28881 MEDIUM

Improper Authorization (CWE-285)

2026-03-25 apple

GHSA-6fm3-x8p8-w9j8

Apple Information Disclosure Authentication Bypass macOS

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15163

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.5

DescriptionCVE.org

A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

A privacy vulnerability in macOS Tahoe allows applications to access sensitive user data that should have been protected through proper data isolation. The vulnerability affects macOS versions prior to 26.4, where sensitive data was not adequately segregated from application access. An attacker or malicious application could exploit this flaw to read protected user information without proper authorization, representing a direct information disclosure risk.

Technical ContextAI

This vulnerability relates to data access control and information disclosure (CWE category for improper access restrictions). The affected technology is Apple's macOS operating system, specifically versions before Tahoe 26.4, as indicated by the CPE string cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. The root cause involves insufficient data isolation mechanisms within the operating system, where sensitive user data was stored in locations or with permissions that allowed unauthorized application access. Apple's remediation approach involved moving sensitive data to properly protected locations with enforced access controls, suggesting the issue was a file system or memory protection boundary problem rather than a cryptographic or protocol weakness.

RemediationAI

Immediately upgrade macOS to version Tahoe 26.4 or later to apply the fix. Users should navigate to System Preferences > General > Software Update and install all available updates to ensure the security patch is applied. Until systems can be updated, users should limit application installations to trusted sources from the Apple App Store and review application permissions in System Preferences > Security & Privacy to restrict app access where possible. For organizations managing multiple systems, deploy macOS 26.4 through mobile device management (MDM) solutions to ensure compliance. Refer to Apple's official security advisory at https://support.apple.com/en-us/126794 for additional guidance and to verify patch status across your environment.