CVE-2026-28877: 
macOS vulnerability analysis and mitigation

CVE-2026-28877 is an authorization bypass vulnerability in the Accounts component of multiple Apple operating systems that allows an installed app to access sensitive user data without proper permission checks. The vulnerability was discovered by Rosyna Keller of Totally Not Malicious Software and disclosed by Apple on March 24, 2026. Affected platforms include iOS and iPadOS (before 18.7.9 and 26.4), macOS Sequoia (before 15.7.5), macOS Sonoma (before 14.8.5), macOS Tahoe (before 26.4), visionOS (before 26.4), and watchOS (before 26.4). It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory iOS 26.4, Apple Advisory macOS Tahoe).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and stems from an authorization issue in the Accounts component due to improper state management. Specifically, the system fails to correctly enforce access controls during certain state transitions, allowing an app with low privileges to bypass authorization checks and read sensitive user account data. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (UI:N), making it exploitable by any installed application on the affected device. No public technical write-up or proof-of-concept code has been identified at this time (Apple Advisory iOS 26.4, Apple Advisory macOS Tahoe).

Successful exploitation allows a malicious or compromised app to access sensitive user data stored in the Accounts subsystem without the user's knowledge or consent, resulting in a high confidentiality impact. There is no integrity or availability impact — the vulnerability is limited to unauthorized data read access. Given the breadth of affected platforms (iOS, iPadOS, macOS, watchOS, visionOS), the potential exposure spans a large number of consumer and enterprise devices, and the accessed account data could include credentials or personal information that enables further attacks (Apple Advisory iOS 26.4, Apple Advisory watchOS 26.4).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4. No configuration-based workaround is available; updating to a patched OS version is the only remediation. Organizations should prioritize deployment across all managed Apple devices, as any installed application could potentially exploit this vulnerability (Apple Advisory iOS 26.4, Apple Advisory macOS Sequoia, Apple Advisory macOS Tahoe).

The vulnerability was part of a broader Apple security update in March 2026 that addressed over 140 vulnerabilities across macOS, iOS, iPadOS, and other platforms, which received coverage from security news outlets and aggregators. The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Apple products that could allow for privilege escalation. No notable individual researcher commentary or significant social media discussion specific to CVE-2026-28877 has been identified beyond standard vulnerability tracking and aggregation (CIS Advisory).