CVE-2026-28829: 
macOS vulnerability analysis and mitigation

CVE-2026-28829 is a permissions issue in the WebDAV component of macOS that allows a malicious app to modify protected parts of the file system. It affects macOS Sonoma (versions 14.0–14.8.5), macOS Sequoia (versions 15.0–15.7.5), and macOS Tahoe (versions 26.0–26.4). The vulnerability was disclosed and patched on March 24, 2026, and was discovered by researcher Sreejith Krishnan R. It carries a CVSS v3.1 base score of 5.5 (Medium), though Feedly categorizes it as HIGH severity (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

The vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) and resides in the WebDAV subsystem of macOS. Insufficient access control restrictions on the WebDAV component allow a locally-executed app to write to or modify file system locations that should be protected by macOS security mechanisms. Exploitation requires user interaction — specifically, a user must run or install a malicious application — and no elevated privileges are required for the attacker. Apple addressed the issue by adding additional restrictions to the permissions handling in the affected component (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

Successful exploitation allows a malicious app to modify protected portions of the macOS file system, which could undermine system integrity, tamper with security-critical files, or facilitate persistence mechanisms. The impact is limited to integrity (no confidentiality or availability impact per the CVSS assessment), and the attack is constrained to the local system. However, unauthorized writes to protected file system areas could potentially be chained with other vulnerabilities to achieve privilege escalation or code execution (Apple Sonoma Advisory, Apple Sequoia Advisory).

Apple has released patches addressing this vulnerability across all affected macOS versions. Users should update to macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, or macOS Tahoe 26.4 or later. As a general precaution, users should avoid installing or running applications from untrusted or unverified sources, and review app permissions through macOS System Settings. No configuration-based workaround is available; updating to a patched version is the only definitive remediation (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

The vulnerability was part of a broader Apple security update in March 2026 that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS. The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Apple products could allow for privilege escalation. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-28829 has been identified beyond standard vulnerability tracking coverage (CIS Advisory).