CVE-2026-28836: Apple macOS Auth Bypass Vulnerability

CVE-2026-28836 Overview

CVE-2026-28836 is a correctness issue in Apple macOS Sonoma that allows an attacker with physical access to silently persist an Apple Account on an erased device. Apple addressed the flaw in macOS Sonoma 14.8.8 through improved validation checks. The weakness is categorized under [CWE-359] Exposure of Private Personal Information to an Unauthorized Actor and is tied to device provisioning logic that survives an erase-and-reinstall workflow.

Critical Impact
An attacker with brief physical possession of a device can retain an Apple Account association after the victim erases the Mac, undermining device resale, hand-off, and lost-device recovery assumptions.

Affected Products

Apple macOS versions prior to Sonoma 14.8.8
Systems where the Apple Account was configured before the erase workflow
Devices reset through standard macOS erase-and-reinstall procedures

Discovery Timeline

2026-09-14 - CVE-2026-28836 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-28836

Vulnerability Analysis

The vulnerability resides in the account-state handling logic that macOS uses during the device erase and reprovisioning workflow. When a user erases a Mac running an affected version of macOS Sonoma, the operating system fails to fully invalidate residual Apple Account associations. An attacker with physical access can leverage this gap to keep an Apple Account silently attached to the device after erasure.

The issue is classified under [CWE-359] because it results in the persistence of personally identifying account data on a device the victim believes has been fully wiped. Successful abuse breaks the trust assumption of Apple's Erase Assistant and the recovery reinstallation workflow. It can also confer control over device-linked services, iCloud sync targets, or Find My relationships on the subsequent user.

Root Cause

Apple's advisory attributes the flaw to insufficient correctness checks during the erase workflow. Account-state validation did not fully verify that Apple Account bindings had been removed before signaling completion of the erase. The fix in macOS Sonoma 14.8.8 introduces improved checks that enforce full account teardown.

Attack Vector

Exploitation requires physical access to the target Mac. The attack does not require prior authentication or user interaction beyond the victim's normal erase workflow. An attacker can prepare the device such that Apple Account state remains silently attached after the victim performs a factory erase. The victim then hands off or sells a device that still exposes account linkage. No public proof-of-concept exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apple Security Support Document for vendor detail.

Detection Methods for CVE-2026-28836

Indicators of Compromise

Presence of an unexpected Apple Account binding on a Mac that was recently erased or reprovisioned
Find My or iCloud activity referencing a device the current owner did not enroll
Discrepancies between the macOS version reported by the device and the expected clean-install baseline

Detection Strategies

Audit System Settings > Apple ID on newly provisioned or reissued Macs to confirm no residual account is attached
Compare device serial numbers against the organization's Apple Business Manager or MDM inventory to identify orphan account associations
Review Find My device lists tied to corporate Apple IDs for entries that should have been released

Monitoring Recommendations

Track macOS version telemetry through mobile device management to identify Macs running versions earlier than Sonoma 14.8.8
Flag devices that complete an erase workflow without a corresponding MDM re-enrollment event
Monitor physical-access-sensitive assets (shared workstations, kiosks, loaner Macs) for unexpected account rebinding

How to Mitigate CVE-2026-28836

Immediate Actions Required

Update all Macs running macOS Sonoma to version 14.8.8 or later
Verify Apple Account detachment after any erase, transfer, or decommissioning workflow
Restrict physical access to Macs prior to reissue, resale, or disposal

Patch Information

Apple resolved CVE-2026-28836 in macOS Sonoma 14.8.8 by adding improved correctness checks that ensure Apple Account state is fully removed during the erase workflow. Administrators should deploy the update through Software Update, mobile device management, or Apple Business Manager. Refer to the Apple Security Support Document for the complete advisory.

Workarounds

Perform device reprovisioning in a physically controlled environment prior to reissue
Manually sign out of the Apple Account and remove the device from Find My before initiating erase
Reinstall macOS from Internet Recovery and confirm no Apple Account is present before returning the device to service

bash

# Confirm macOS build is at or above the patched version
sw_vers -productVersion

# Enumerate MDM-enrolled Macs still on vulnerable Sonoma builds
mdmclient QueryDeviceInformation | grep -i OSVersion