CVE-2026-28867: Apple OS Information Disclosure Flaw

CVE-2026-28867 Overview

CVE-2026-28867 is an authentication vulnerability affecting multiple Apple operating systems that allows a malicious application to leak sensitive kernel state information. Apple addressed this issue with improved authentication mechanisms across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS platforms.

Critical Impact

A malicious application exploiting this vulnerability could bypass authentication controls and access sensitive kernel memory state, potentially exposing privileged system information that could facilitate further attacks.

Affected Products

• iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier
• iOS 26.4 and earlier, iPadOS 26.4 and earlier
• macOS Sequoia 15.7.5 and earlier
• macOS Tahoe 26.4 and earlier
• tvOS 26.4 and earlier
• visionOS 26.4 and earlier
• watchOS 26.4 and earlier

Discovery Timeline

• 2026-03-25 - CVE-2026-28867 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28867

Vulnerability Analysis

This vulnerability stems from insufficient authentication validation within Apple's kernel subsystem. When an application makes certain system calls or interacts with kernel interfaces, the authentication mechanism failed to properly verify the caller's authorization level before exposing kernel state information.

The information leak affects the kernel memory space, which typically contains sensitive data structures, pointers, and system configuration details. Exposure of kernel state information can be leveraged by attackers to defeat kernel address space layout randomization (KASLR), identify exploitable memory layouts, or gather intelligence for subsequent privilege escalation attacks.

Root Cause

The root cause of CVE-2026-28867 lies in improper authentication checks within the kernel's interface handlers. The vulnerability allowed applications running in user space to query or access kernel state information without proper credential verification. Apple's fix implemented improved authentication controls to ensure that only authorized processes can access sensitive kernel state data.

Attack Vector

Exploitation of this vulnerability requires a malicious application to be installed and executed on the target device. The attack is local in nature, meaning an attacker would need to either:

1. Convince a user to install a malicious application
2. Exploit an existing application to execute malicious code
3. Gain initial access to the device through other means

Once executed, the malicious application can leverage the authentication bypass to query kernel interfaces and extract sensitive state information. This information could then be exfiltrated or used locally to chain with other vulnerabilities for privilege escalation.

The vulnerability affects the entire Apple ecosystem, including mobile devices (iOS, iPadOS), desktop systems (macOS), entertainment devices (tvOS), wearables (watchOS), and spatial computing platforms (visionOS).

Detection Methods for CVE-2026-28867

Indicators of Compromise

• Unusual system calls or kernel interface queries from non-system applications
• Applications attempting to access kernel memory regions or state information
• Unexpected data exfiltration patterns from devices to unknown external endpoints
• Anomalous behavior from recently installed or updated applications

Detection Strategies

• Monitor for applications making unusual kernel-related API calls or system requests
• Implement application behavior analysis to detect unauthorized kernel state queries
• Review installed applications for suspicious permissions or behaviors
• Enable comprehensive logging of system calls on managed devices

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions capable of monitoring kernel-level activity
• Implement mobile device management (MDM) policies to restrict application installations to trusted sources
• Monitor network traffic for potential data exfiltration following kernel information access
• Enable security audit logging on macOS systems to track privileged operations

How to Mitigate CVE-2026-28867

Immediate Actions Required

• Update all affected Apple devices to the latest available OS versions immediately
• Review recently installed applications on affected devices for suspicious behavior
• Restrict application installations to trusted sources (App Store only)
• Implement mobile device management (MDM) controls for enterprise environments

Patch Information

Apple has released security updates to address this vulnerability across all affected platforms. Organizations and users should apply the following updates:

• iOS/iPadOS: Update to iOS 18.7.7 or iOS 26.4 (or later)
• macOS: Update to macOS Sequoia 15.7.5 or macOS Tahoe 26.4 (or later)
• tvOS: Update to tvOS 26.4 (or later)
• visionOS: Update to visionOS 26.4 (or later)
• watchOS: Update to watchOS 26.4 (or later)

For detailed patch information, refer to the official Apple security advisories:

• Apple Security Update 126792
• Apple Security Update 126793
• Apple Security Update 126794
• Apple Security Update 126795
• Apple Security Update 126797
• Apple Security Update 126798
• Apple Security Update 126799

Workarounds

• Enable automatic software updates on all Apple devices to receive security patches promptly
• Restrict device usage to applications from the official App Store only
• Implement application allowlisting on managed enterprise devices
• Consider isolating unpatched devices from sensitive network resources until updates can be applied