CVE-2026-28945: Apple macOS Auth Bypass Vulnerability

CVE-2026-28945 Overview

CVE-2026-28945 is a permissions vulnerability in Apple macOS that allows a local application to bypass network restrictions. Apple addressed the issue by applying additional sandbox restrictions in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The flaw is classified under [CWE-284] Improper Access Control and requires local access with user interaction.

Critical Impact
An app running on an affected macOS system may bypass sandbox network restrictions, enabling unauthorized network communication that violates the platform's isolation guarantees.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-28945 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-28945

Vulnerability Analysis

CVE-2026-28945 stems from an improper access control condition [CWE-284] in the macOS sandbox enforcement layer. The sandbox is designed to constrain applications to a defined set of resources, including network endpoints. A permissions gap allowed a locally installed app to circumvent these network restrictions and communicate outside its permitted scope.

Apple's advisory states the issue was resolved by adding additional sandbox restrictions. This indicates the original policy did not fully mediate certain network operations, leaving a bypass available to sandboxed processes. Exploitation requires the attacker to first deliver and execute code locally, and user interaction is required to trigger the vulnerable path.

The integrity and confidentiality impacts are both rated high because a successful bypass permits an app to reach network destinations it should not, potentially exfiltrating data or contacting attacker-controlled infrastructure while appearing to comply with sandbox policy.

Root Cause

The root cause is an incomplete sandbox policy that failed to restrict specific network operations available to sandboxed applications. Apple's fix tightens the sandbox profile to close the gap. No further technical detail on the affected system component has been published in the advisory.

Attack Vector

An attacker must convince a user to install and run a malicious or compromised application on the target Mac. Once executed, the app leverages the sandbox permissions gap to reach network resources that policy would normally block. The vulnerability is not exploitable remotely without prior local code execution.

No public proof-of-concept exploit or exploit database entry has been published for this CVE. See Apple Security Advisory #128067, Apple Security Advisory #128071, and Apple Security Advisory #128072 for vendor detail.

Detection Methods for CVE-2026-28945

Indicators of Compromise

Sandboxed applications initiating outbound network connections to endpoints not declared in their entitlements or expected communication profile.
Unsigned or ad-hoc signed applications executing on endpoints that lack the fixed macOS versions.
Anomalous DNS queries or TCP sessions originating from processes normally scoped to local-only operation.

Detection Strategies

Correlate process execution events with network connection telemetry to flag sandboxed apps that generate unexpected external traffic.
Monitor for macOS builds older than 15.7.8, 14.8.8, and 26.6 across the fleet and prioritize them for patching and enhanced monitoring.
Baseline entitlement-to-network behavior for critical applications and alert on deviations.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework and Unified Log data into a centralized analytics pipeline for retrospective hunting.
Track outbound connections from user-installed apps against organizational allowlists.
Alert on new or unsigned applications launched with network access on endpoints that have not yet received the July 2026 macOS updates.

How to Mitigate CVE-2026-28945

Immediate Actions Required

Update affected endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Inventory macOS assets and prioritize systems that handle sensitive data or operate in restricted network segments.
Restrict installation of unvetted third-party applications through mobile device management (MDM) policy.

Patch Information

Apple has released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Refer to Apple Security Advisory #128067, Apple Security Advisory #128071, and Apple Security Advisory #128072 for the corresponding advisories and update instructions.

Workarounds

Enforce application allowlisting through MDM to prevent execution of untrusted apps on unpatched Macs.
Apply network segmentation and egress filtering to limit the destinations reachable from user endpoints.
Require Gatekeeper and notarization checks and disable running of ad-hoc or unsigned binaries where feasible.

bash

# Verify installed macOS version against fixed builds
sw_vers -productVersion

# Trigger a software update check via MDM or locally
sudo softwareupdate --list
sudo softwareupdate --install --all --restart