CVE-2026-28864: 
macOS vulnerability analysis and mitigation

CVE-2026-28864 is an incorrect authorization vulnerability in Apple's Security framework (Keychain) that allows a local attacker to gain unauthorized access to a user's Keychain items. It was discovered by Alex Radocea and disclosed on March 24, 2026, as part of Apple's March 2026 security update batch. Affected platforms include iOS prior to 18.7.7 and 26.4, iPadOS prior to 18.7.7 and 26.4, macOS Sonoma prior to 14.8.5, macOS Sequoia prior to 15.7.5, macOS Tahoe prior to 26.4, visionOS prior to 26.4, and watchOS prior to 26.4. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) (Apple Advisory iOS 26.4, Apple Advisory iOS 18.7.7, Apple Advisory macOS Tahoe).

The root cause is classified as CWE-863 (Incorrect Authorization) — specifically, insufficient permissions checking within Apple's Security framework governing Keychain access control. The attack vector is local, requiring user interaction, with no privileges required, meaning a malicious app or local attacker can exploit the flaw without elevated rights if the user can be induced to interact with the device. Apple addressed the issue by implementing improved permissions checking in the affected Security component. No public proof-of-concept or detailed technical write-up describing the precise exploitation mechanism has been published as of the time of this report (Apple Advisory iOS 26.4, Apple Advisory macOS Sequoia).

Successful exploitation allows a local attacker to read sensitive Keychain items belonging to the user, which may include stored passwords, authentication tokens, certificates, and other credentials managed by the Apple Keychain. The confidentiality impact is limited in scope (CVSS confidentiality: Low), with no integrity or availability impact, and exploitation does not cross security boundaries beyond the affected user's Keychain. However, access to Keychain credentials could enable secondary attacks such as account takeover or lateral movement if the exposed credentials are reused across services (Apple Advisory iOS 18.7.7, Apple Advisory macOS Sonoma).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4. No configuration-based workaround is available; updating to a patched version is the only recommended remediation. Administrators should ensure Automatic Updates are enabled on managed devices to receive these protections promptly (Apple Advisory iOS 18.7.7, Apple Advisory macOS Sequoia, Apple Advisory macOS Sonoma).

The vulnerability was part of a large March 2026 Apple security update that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and other platforms, which received broad coverage from security-focused media outlets. Coverage noted the Keychain access flaw alongside higher-severity issues such as the DarkSword exploit mitigations included in iOS 18.7.7. The CIS issued an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation. No notable individual researcher commentary specific to CVE-2026-28864 beyond the discoverer credit (Alex Radocea of Supernetworks, Inc.) has been publicly identified (Apple Advisory iOS 26.4, CIS Advisory).