CVE-2026-28862: Apple macOS Information Disclosure Flaw

CVE-2026-28862 Overview

CVE-2026-28862 is an Information Exposure vulnerability affecting Apple macOS systems. The vulnerability stems from inadequate private data redaction for log entries, potentially allowing malicious applications to access user-sensitive data. Apple has addressed this issue by implementing improved private data redaction mechanisms for log entries across multiple macOS versions.

Critical Impact

A malicious application installed on affected macOS systems may be able to access user-sensitive data through improperly redacted log entries, potentially leading to privacy violations and unauthorized data exposure.

Affected Products

• macOS Sequoia (versions prior to 15.7.5)
• macOS Sonoma (versions prior to 14.8.5)
• macOS Tahoe (versions prior to 26.4)

Discovery Timeline

• 2026-03-25 - CVE-2026-28862 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28862

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), specifically relating to how macOS handles the redaction of private data within system log entries. When applications write log entries containing sensitive user information, the operating system should apply appropriate redaction filters to prevent unauthorized access to this data. However, due to insufficient implementation of these redaction mechanisms, sensitive user data may remain accessible within log files.

The vulnerability can be exploited by applications running on the affected system without requiring elevated privileges. An attacker who has already gained code execution on a target macOS system—whether through a malicious app downloaded by the user or through another exploit chain—could leverage this vulnerability to extract sensitive user information from log entries that should have been protected.

Root Cause

The root cause of CVE-2026-28862 lies in the insufficient implementation of private data redaction filters for log entries in macOS. The logging subsystem failed to properly sanitize or redact sensitive user information before writing it to log files, allowing applications with read access to these logs to potentially extract private data.

Attack Vector

The attack vector for this vulnerability is network-based, though exploitation requires local application execution on the target system. An attacker could deliver a malicious application through various means (phishing, malicious downloads, compromised software updates) that, once installed, reads system log files to harvest user-sensitive data that should have been redacted.

The vulnerability mechanism involves the logging subsystem writing sensitive user data to log entries without proper redaction. Applications with appropriate permissions to read log files can then access this data. The attack does not require user interaction beyond the initial installation of a malicious application.

Detection Methods for CVE-2026-28862

Indicators of Compromise

• Unusual application processes attempting to read system log files in /var/log/ or ~/Library/Logs/
• Applications requesting unexpected permissions to access system diagnostics or logging data
• Suspicious patterns of log file access from non-system applications

Detection Strategies

• Monitor for applications attempting to access macOS unified logging system data using log command or related APIs
• Implement endpoint detection rules to flag unusual log file read operations from third-party applications
• Review installed applications for unexpected logging or diagnostic data access requests

Monitoring Recommendations

• Enable file access auditing for sensitive log directories on macOS endpoints
• Deploy SentinelOne agents configured to monitor for suspicious file access patterns targeting system logs
• Regularly audit installed applications and their permission requests on enterprise macOS systems

How to Mitigate CVE-2026-28862

Immediate Actions Required

• Update all macOS systems to the patched versions: macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, or macOS Tahoe 26.4
• Review recently installed applications for potentially malicious software
• Audit system log files for evidence of unauthorized access or data exposure

Patch Information

Apple has released security updates addressing this vulnerability. Organizations should apply the following updates immediately:

• macOS Sequoia 15.7.5 - See Apple Security Advisory #126794
• macOS Sonoma 14.8.5 - See Apple Security Advisory #126795
• macOS Tahoe 26.4 - See Apple Security Advisory #126796

Workarounds

• Restrict application installation to trusted sources and enable Gatekeeper to block unsigned applications
• Implement strict application allowlisting policies on enterprise macOS systems
• Regularly clear log files that may contain sensitive information until systems can be patched

# Check current macOS version
sw_vers

# Verify system updates are available
softwareupdate --list

# Apply available security updates
softwareupdate --install --all