CVE-2026-28912 Overview
CVE-2026-28912 is a local privilege escalation vulnerability in Apple macOS caused by a logic flaw in permission enforcement. Apple addressed the issue by tightening restrictions in the affected component. A local user with low-privilege access can leverage the flaw to elevate privileges on the system. Apple has fixed the issue in macOS Sequoia 15.7.8 and macOS Tahoe 26.6. The weakness is classified under [CWE-693] (Protection Mechanism Failure).
Critical Impact
A local attacker with a low-privilege account can elevate privileges, achieving high impact to confidentiality, integrity, and availability on the compromised macOS host.
Affected Products
- Apple macOS Sequoia versions prior to 15.7.8
- Apple macOS Tahoe versions prior to 26.6
- Apple macOS (see vendor advisories for full list of impacted builds)
Discovery Timeline
- 2026-07-27 - CVE-2026-28912 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-28912
Vulnerability Analysis
CVE-2026-28912 stems from a logic error in a macOS component responsible for enforcing privilege boundaries. Apple's advisory describes the fix as "improved restrictions," indicating that the original protection mechanism did not fully constrain the actions available to unprivileged callers. The flaw maps to [CWE-693], Protection Mechanism Failure, where an existing security control is present but does not adequately block the attack path.
Exploitation requires local access and low privileges on the target system. No user interaction is required to trigger the flaw. A successful attacker gains elevated privileges, enabling read, write, and execution capabilities beyond the original session's authorization boundary.
Root Cause
The root cause is a logic issue in privilege validation. The affected component evaluated a request in a way that permitted an unauthorized state transition. Apple's mitigation adds stricter checks so the operation is denied when the caller does not hold the required entitlements. Apple has not publicly disclosed the specific subsystem or code path.
Attack Vector
An attacker must already have code execution on the macOS host as a standard user or through a compromised application. From that foothold, the attacker invokes the vulnerable interface to move from a low-privileged context to an elevated one, such as root or a highly entitled service account. This class of flaw is commonly chained after initial access from phishing, malicious installers, or exploitation of a sandboxed application.
No public proof-of-concept or in-the-wild exploitation has been reported at publication time. Refer to the Apple Support Article #128067 and Apple Support Article #128071 for vendor-published details.
Detection Methods for CVE-2026-28912
Indicators of Compromise
- Unexpected transitions of user processes to root or system-level accounts on macOS endpoints running versions prior to 15.7.8 or 26.6.
- New or unsigned LaunchDaemons, LaunchAgents, or persistence artifacts written under /Library/LaunchDaemons/ or /Library/LaunchAgents/ shortly after user login.
- Unusual sudo, authd, or XPC service activity originating from non-administrative user sessions.
Detection Strategies
- Monitor endpoint telemetry for privilege elevation events where the parent process is a standard user application and the child process runs with elevated entitlements.
- Correlate process creation events with authentication logs to identify elevation without a corresponding administrator authentication prompt.
- Baseline system daemons and alert on modifications to files under /System, /Library, or protected TCC databases originating from unprivileged callers.
Monitoring Recommendations
- Ingest macOS Unified Logs, Endpoint Security Framework events, and audit records into a centralized analytics platform.
- Track macOS OS build versions across the fleet and alert on hosts still running versions below 15.7.8 or 26.6.
- Review installations of software packages and pkg installers that request elevated privileges during the exposure window.
How to Mitigate CVE-2026-28912
Immediate Actions Required
- Update all Apple macOS Sequoia hosts to 15.7.8 and macOS Tahoe hosts to 26.6 or later.
- Inventory endpoints by OS build and prioritize patching for systems used by administrators, developers, and privileged accounts.
- Restrict local user rights and audit which accounts can execute untrusted binaries or install third-party software.
Patch Information
Apple resolved CVE-2026-28912 in macOS Sequoia 15.7.8 and macOS Tahoe 26.6 by applying improved restrictions to the affected logic. Patch details are available in Apple Support Article #128067 and Apple Support Article #128071. Deploy updates through Apple's Software Update mechanism or an MDM solution such as Jamf, Kandji, or Intune.
Workarounds
- No official workaround exists; apply the vendor patch as the primary remediation.
- Reduce local attack surface by removing unnecessary standard-user access to shared macOS workstations.
- Enforce application allowlisting and Gatekeeper policies to limit execution of unsigned or unknown binaries that could serve as the initial foothold.
# Verify the installed macOS version on an endpoint
sw_vers -productVersion
# Trigger a software update check (requires admin)
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
