CVE-2026-28910: Apple macOS Privilege Escalation Flaw

CVE-2026-28910 Overview

CVE-2026-28910 is a permissions checking flaw in Apple macOS that allows a malicious application to access arbitrary files. Apple addressed the issue in macOS Tahoe 26.4 through improved permissions checking. The vulnerability requires local access and low privileges, with no user interaction required for exploitation. The flaw maps to [CWE-284: Improper Access Control] and impacts only file confidentiality, with no direct integrity or availability impact.

Critical Impact
A malicious app installed on the local system may bypass permissions checks to read arbitrary files outside its authorized sandbox or container.

Affected Products

Apple macOS versions prior to macOS Tahoe 26.4
Systems running unpatched macOS Tahoe builds
Endpoints where third-party or unsigned applications can be installed

Discovery Timeline

2026-05-11 - CVE-2026-28910 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28910

Vulnerability Analysis

The vulnerability stems from improper access control enforcement in a macOS component prior to macOS Tahoe 26.4. A malicious application with local user privileges can leverage the flaw to access files it should not be permitted to read. Apple's advisory states the issue was addressed with improved permissions checking, indicating the original logic failed to fully validate a caller's entitlements or path-resolution context before granting file access. The vulnerability is local in scope and does not yield code execution, integrity loss, or availability impact on its own. However, file read primitives commonly serve as a stepping stone for broader compromise, including credential theft and reconnaissance for privilege escalation.

Root Cause

The root cause is improper access control [CWE-284] within a macOS subsystem responsible for mediating file access requests. Permissions validation logic did not adequately restrict what a low-privileged process could reach, enabling reads outside the expected authorization boundary. Apple's fix introduces stricter permission checks before file operations are permitted.

Attack Vector

Exploitation requires a malicious application to execute locally with low-privilege user context. No user interaction is required once the malicious app runs. The attacker invokes the vulnerable API or pathway and receives access to files that would normally be blocked by macOS access control. Typical post-exploitation targets include user documents, keychain artifacts, browser data, and configuration files containing tokens or credentials. Refer to the Apple Support Article for vendor technical details.

Detection Methods for CVE-2026-28910

Indicators of Compromise

Unsigned or recently installed applications issuing unusual open(), read(), or path-resolution syscalls against sensitive directories such as ~/Library, ~/Documents, or /private/var.
Processes accessing files outside their declared sandbox container or App Sandbox profile.
Anomalous file read activity from non-system binaries shortly after application launch.

Detection Strategies

Monitor Endpoint Security framework (ES) events for ES_EVENT_TYPE_NOTIFY_OPEN calls targeting high-value paths from low-reputation binaries.
Correlate process execution telemetry with file access events to flag applications reading data inconsistent with their declared functionality.
Audit installed applications for macOS version compatibility and confirm that hosts have been upgraded to macOS Tahoe 26.4 or later.

Monitoring Recommendations

Enable Unified Logging for com.apple.TCC and sandbox subsystems to capture permission denial and bypass attempts.
Track installation of new applications from outside the Mac App Store and flag those requesting access to protected directories.
Maintain inventory of macOS build versions across the fleet to identify endpoints still vulnerable to CVE-2026-28910.

How to Mitigate CVE-2026-28910

Immediate Actions Required

Upgrade affected systems to macOS Tahoe 26.4 or later, which contains Apple's improved permissions checking fix.
Audit installed third-party applications and remove software from untrusted sources.
Restrict standard users from installing arbitrary applications via MDM configuration profiles.

Patch Information

Apple released the fix in macOS Tahoe 26.4. Administrators should deploy the update through Apple Software Update or MDM solutions such as Jamf, Intune, or Kandji. See the Apple Support Article for full release notes and the complete list of addressed CVEs.

Workarounds

No vendor-supplied workaround exists; patching to macOS Tahoe 26.4 is the only complete remediation.
Limit local application installation rights and enforce Gatekeeper with notarization requirements until patching is complete.
Apply Transparency, Consent, and Control (TCC) policies via MDM to minimize the data exposed to unprivileged applications.

bash

# Verify current macOS version and check for available updates
sw_vers -productVersion
sudo softwareupdate --list
sudo softwareupdate --install --all --restart