CVE-2026-28951: Apple iPadOS Privilege Escalation Flaw

CVE-2026-28951 Overview

CVE-2026-28951 is an authorization vulnerability affecting multiple Apple operating systems. The flaw stems from improper state management in the authorization logic, allowing a local application to gain root privileges on a vulnerable device. Apple addressed the issue with improved state management across iOS, iPadOS, and macOS.

The vulnerability maps to [CWE-863: Incorrect Authorization]. Successful exploitation requires local access and low privileges, but yields full compromise of confidentiality, integrity, and availability. Apple released fixes in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5.

Critical Impact

A local application can escalate to root privileges, granting attackers complete control over the affected Apple device.

Affected Products

• Apple iOS and iPadOS (versions prior to 18.7.9 and 26.5)
• Apple macOS Sequoia (prior to 15.7.7), macOS Sonoma (prior to 14.8.7), and macOS Tahoe (prior to 26.5)
• iPhone and iPad devices running unpatched iOS/iPadOS builds

Discovery Timeline

• 2026-05-11 - CVE-2026-28951 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28951

Vulnerability Analysis

The vulnerability resides in an authorization routine within Apple's operating systems that fails to correctly track internal state. When the authorization decision relies on transient state that an attacker can influence or desynchronize, the system grants access to operations it should reject. Apple's advisory describes the remediation as improved state management, indicating the original code lacked atomic or consistent checks across the authorization flow.

The consequence is privilege escalation. A standard user-mode application running on the device can manipulate the authorization sequence to obtain root-level execution. Once root is achieved, the attacker can disable security controls, install persistent components, access protected user data, and modify system binaries.

Root Cause

The root cause is incorrect authorization tied to improper state management [CWE-863]. Authorization decisions in the affected component depend on state variables that can transition into an unintended configuration. An attacker who triggers this state divergence bypasses the privilege check, even though the code path appears to enforce it. Apple's fix introduces stricter state validation to ensure the authorization decision reflects the actual runtime context.

Attack Vector

Exploitation requires local access through a malicious or compromised application. The attacker does not need user interaction beyond launching the app, which can be delivered via sideloading on macOS, enterprise provisioning, or a Trojanized App Store submission that abuses runtime behavior. After execution, the app triggers the vulnerable authorization path to acquire root. Apple has not reported in-the-wild exploitation, and no public proof-of-concept exists at this time.

No verified exploit code is available for CVE-2026-28951. Refer to Apple's security advisories listed in the references for technical disclosure boundaries.

Detection Methods for CVE-2026-28951

Indicators of Compromise

• Unexpected processes running with root or uid=0 that were spawned from user-installed applications.
• New or modified files in privileged locations such as /Library/LaunchDaemons/, /System/Library/, or /usr/local/bin/ originating from non-administrative user sessions.
• Unauthorized changes to System Integrity Protection (SIP) configuration, kernel extensions, or TCC database entries.

Detection Strategies

• Monitor endpoint telemetry for child processes that escalate privileges immediately after launch from user-writable paths such as ~/Downloads, ~/Library/Application Support, or /Applications.
• Audit authd and securityd log entries for anomalous authorization grants or repeated state transitions in short time windows.
• Inventory device OS versions and flag endpoints running builds below iOS/iPadOS 18.7.9, iOS/iPadOS 26.5, macOS 14.8.7, macOS 15.7.7, or macOS 26.5.

Monitoring Recommendations

• Forward Endpoint Security Framework (ESF) events and unified logs to a centralized SIEM for behavioral analytics on privilege escalation patterns.
• Alert on any process executing setuid(0) or invoking authorization APIs from contexts that historically operate at standard user privilege.
• Track installation of unsigned or ad-hoc-signed applications on managed macOS fleets through MDM compliance reports.

How to Mitigate CVE-2026-28951

Immediate Actions Required

• Update all Apple devices to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, or macOS Tahoe 26.5 immediately.
• Enforce patch deployment through Mobile Device Management (MDM) policies and verify compliance across the fleet.
• Restrict installation of unsigned or sideloaded applications on managed endpoints using Gatekeeper and notarization policies.

Patch Information

Apple released security updates addressing CVE-2026-28951 across its operating system portfolio. Patch details and download links are available in the vendor advisories: Apple Support Article #127110, Apple Support Article #127111, Apple Support Article #127115, Apple Support Article #127116, and Apple Support Article #127117.

Workarounds

• No vendor-supplied workaround exists. Apply the security update as the only supported remediation.
• Limit user permissions and prohibit installation of untrusted applications until patches are deployed.
• Enable application allow-listing on macOS endpoints and restrict execution from user-writable directories where feasible.

# Verify macOS build version after patching
sw_vers -productVersion

# Check available Apple software updates
sudo softwareupdate --list

# Install all recommended updates
sudo softwareupdate --install --all --restart