CVE-2026-28821

A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain elevated privileges.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/126794	Release Notes Vendor Advisory
https://support.apple.com/en-us/126795	Release Notes Vendor Advisory
https://support.apple.com/en-us/126796	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

History

17 Jun 2026, 10:29

Type	Values Removed	Values Added
Summary		(es) Existía un problema de validación en la verificación de derechos. Este problema se abordó con una validación mejorada del derecho del proceso. Este problema está solucionado en macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Una aplicación podría obtener privilegios elevados.

26 Mar 2026, 14:16

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-20
CVSS	v2 : ~~unknown~~ v3 : ~~6.5~~	v2 : unknown v3 : 8.4

25 Mar 2026, 21:31

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CWE		CWE-284
First Time		Apple macos Apple
CPE		cpe:2.3:o:apple:macos::::::::
References	~~() https://support.apple.com/en-us/126794 -~~	() https://support.apple.com/en-us/126794 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/126795 -~~	() https://support.apple.com/en-us/126795 - Release Notes, Vendor Advisory
References	~~() https://support.apple.com/en-us/126796 -~~	() https://support.apple.com/en-us/126796 - Release Notes, Vendor Advisory

25 Mar 2026, 01:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-25 01:17

Updated : 2026-06-17 10:29

NVD link : CVE-2026-28821

Mitre link : CVE-2026-28821

CVE.ORG link : CVE-2026-28821

JSON object : View

Products Affected

apple

macos

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-28821", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28821", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T03:55:29.069829Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "14.8.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "15.7.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}]}], "published": "2026-03-25T01:17:07.280", "references": [{"url": "https://support.apple.com/en-us/126794", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/126795", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/126796", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to gain elevated privileges."}, {"lang": "es", "value": "Exist\u00eda un problema de validaci\u00f3n en la verificaci\u00f3n de derechos. Este problema se abord\u00f3 con una validaci\u00f3n mejorada del derecho del proceso. Este problema est\u00e1 solucionado en macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Una aplicaci\u00f3n podr\u00eda obtener privilegios elevados."}], "lastModified": "2026-06-17T10:29:06.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D66288AF-23BD-407A-81F5-F1DFBF84C622", "versionEndExcluding": "14.8.5", "versionStartIncluding": "14.0"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD21D2C9-BBEC-4E8E-B8D2-C92B7E6155E1", "versionEndExcluding": "15.7.5", "versionStartIncluding": "15.0"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}