CVE-2026-28844: 
macOS vulnerability analysis and mitigation

CVE-2026-28844 is a file access vulnerability in Apple macOS affecting the SystemMigration component, where insufficient input validation allows an attacker to gain unauthorized access to protected parts of the file system. It was disclosed and patched on March 24, 2026, as part of the macOS Tahoe 26.4 security update. The vulnerability affects macOS Tahoe versions prior to 26.4 and was credited to researcher Pedro Tôrres (@t0rr3sp3dr0). It carries a CVSS v3.1 base score of 6.5 (Medium/High), with network-based attack vector requiring user interaction (Apple Advisory).

The root cause is a file access issue (CWE-22, path traversal/improper input validation) in the macOS SystemMigration component, addressed by Apple through improved input validation. An unauthenticated network attacker can exploit this vulnerability to read files from protected filesystem areas, but user interaction is required to trigger the vulnerable code path. No public technical write-ups or proof-of-concept code have been identified at this time (Apple Advisory).

Successful exploitation results in unauthorized read access to protected parts of the macOS file system, representing a high confidentiality impact with no integrity or availability impact. Sensitive files that are normally restricted by macOS filesystem protections could be exposed to an attacker operating over the network. There is no evidence of lateral movement capability or privilege escalation directly from this vulnerability (Apple Advisory).

Apple has released a fix in macOS Tahoe 26.4, available as of March 24, 2026. Users and administrators should update all affected macOS Tahoe systems to version 26.4 or later to remediate this vulnerability. No configuration-based workarounds have been published by Apple (Apple Advisory).

CVE-2026-28844 was part of a large March 2026 Apple security update that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and tvOS, which received broad coverage in the security community. The SANS Internet Storm Center and security aggregators such as BeyondMachines noted the scale of the release. No specific researcher commentary or notable social media discussion focused exclusively on this individual CVE has been identified.