CVE-2026-28816: 
macOS vulnerability analysis and mitigation

CVE-2026-28816 is a path handling vulnerability in the macOS Notes component that allows an app to delete files for which it does not have permission. It affects Apple macOS Sonoma (versions 14.0–14.8.5), macOS Sequoia (versions 15.0–15.7.5), and macOS Tahoe (versions 26.0–26.4). The vulnerability was disclosed and patched on March 24, 2026, and was discovered by Dawuge of Shuffle Team and Hunan University. It carries a CVSS v3.1 base score of 4.0 (Medium) (Apple Advisory - Tahoe, Apple Advisory - Sequoia, Apple Advisory - Sonoma).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The root cause is insufficient validation of file paths within the macOS Notes component, which allows a locally running application to construct or manipulate paths in a way that bypasses permission checks and triggers deletion of files outside its authorized scope. The attack vector is local (AV:L), requires no privileges (PR:N), and no user interaction (UI:N), meaning a malicious app running on the system could exploit this without any special entitlements or user prompting. Apple addressed the issue with improved path validation (Apple Advisory - Tahoe, Apple Advisory - Sequoia).

Successful exploitation allows a malicious application to delete arbitrary files on the macOS system for which it would not normally have permission, resulting in an integrity impact. There is no confidentiality or availability impact identified (CVSS: C:N/I:L/A:N), meaning the vulnerability does not expose sensitive data or crash systems directly, but unauthorized file deletion could disrupt application functionality or remove important user or system files. The scope is limited to the local system and does not facilitate lateral movement or remote exploitation (Apple Advisory - Sonoma, Apple Advisory - Sequoia).

Apple has released patches addressing this vulnerability in the following macOS versions: macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, and macOS Tahoe 26.4, all released on March 24, 2026. Users should update their macOS installations to these versions or later as soon as possible. As an additional precaution, restricting local system access to authorized users only can reduce the risk of exploitation by untrusted applications (Apple Advisory - Tahoe, Apple Advisory - Sequoia, Apple Advisory - Sonoma).

The vulnerability was part of a broader Apple security update in March 2026 that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS, which received general coverage from security news outlets and aggregators. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-28816 has been identified, consistent with its medium severity rating and lack of active exploitation.