CVE-2026-28818: 
macOS vulnerability analysis and mitigation

CVE-2026-28818 is a logging issue in the macOS Spotlight component that allows an app to access sensitive user data due to inadequate data redaction in system logs. It was disclosed by Apple on March 24, 2026, and affects macOS Sonoma (14.0–14.8.5), macOS Sequoia (15.0–15.7.5), and macOS Tahoe (26.0–26.4). The vulnerability was reported by @pixiepointsec and is classified as CWE-284 (Improper Access Control). It carries an estimated CVSS v3.1 base score of 5.3 (Medium) (Apple Advisory Sonoma, Apple Advisory Sequoia, Apple Advisory Tahoe).

The root cause is a logging issue in the macOS Spotlight subsystem where sensitive user data is insufficiently redacted before being written to system logs, classified as CWE-284 (Improper Access Control). An application running on the affected system can read these log entries and thereby access sensitive user data that should have been masked or omitted. The fix involved improved data redaction in the logging functions within Spotlight. No public proof-of-concept or detailed technical write-up has been published as of the time of this report (Apple Advisory Sonoma, Apple Advisory Sequoia, Apple Advisory Tahoe).

Successful exploitation allows a malicious application to read sensitive user data exposed in Spotlight's system log entries, resulting in a confidentiality impact. There is no integrity or availability impact associated with this vulnerability. The scope is limited to the local system, and while lateral movement is not directly enabled, exposure of sensitive data (such as file paths, search queries, or personal information indexed by Spotlight) could facilitate further targeted attacks (Apple Advisory Sonoma, Apple Advisory Sequoia).

Apple has released patches addressing this vulnerability in macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, and macOS Tahoe 26.4, all released on March 24, 2026. Users should update their macOS installations to these versions or later via System Settings > Software Update. No configuration-based workaround has been published; upgrading to a patched version is the only recommended remediation (Apple Advisory Sonoma, Apple Advisory Sequoia, Apple Advisory Tahoe).

The vulnerability was part of a broader March 2026 Apple security update that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS. The CIS noted the update in an advisory covering multiple Apple product vulnerabilities. No significant individual researcher commentary or notable social media discussion specific to CVE-2026-28818 has been identified beyond standard vulnerability tracking coverage (CIS Advisory).