CVE-2026-28853

7.8High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-269

Impact

A local application can elevate privileges to compromise confidentiality, integrity, and system availability. The attacker requires local access and the ability to execute an app on the host.

Root cause

Improper privilege management and inadequate security checks allow an unprivileged application to gain elevated rights.

Affected systems

macOS Sequoia versions prior to 15.8, macOS Tahoe versions prior to 26.7.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to macOS Sequoia 15.8 or macOS Tahoe 26.7; no interim workarounds or mitigations are provided.

shell

$ softwareupdate -ia --include-config-data

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-28853