CVE-2026-28880: 
macOS vulnerability analysis and mitigation

CVE-2026-28880 is a permissions/improper access control vulnerability in Apple's iCloud component that allows an installed app to enumerate a user's installed applications without proper authorization. It was disclosed and patched on March 24, 2026, affecting iOS prior to 18.7.7, iOS 26.x prior to 26.4, iPadOS prior to 18.7.7, iPadOS 26.x prior to 26.4, macOS Sonoma prior to 14.8.5, macOS Sequoia prior to 15.7.5, macOS Tahoe prior to 26.4, and visionOS prior to 26.4. The vulnerability was discovered by Zhongcheng Li from IES Red Team (ByteDance) and carries a CVSS v3.1 base score of 6.5 (Medium) (Apple iOS 26.4 Advisory, Apple iOS 18.7.7 Advisory, Apple macOS Tahoe Advisory).

The root cause is classified as CWE-284 (Improper Access Control) — specifically, insufficient permission restrictions within the iCloud component that allow any installed app to query and enumerate the list of applications installed on the device. Apple addressed the issue by applying additional restrictions to the relevant permissions checks. The vulnerability does not require user interaction or elevated privileges to exploit, as any app installed on the device can leverage the flaw. No public proof-of-concept code or detailed technical write-up has been identified at this time (Apple iOS 26.4 Advisory, Apple macOS Sequoia Advisory).

Successful exploitation results in an information disclosure impact: a malicious app can silently enumerate the full list of applications installed on a victim's device, revealing potentially sensitive information about the user's software inventory (e.g., banking apps, health apps, VPN clients, or security tools). This data can be used for targeted reconnaissance, user profiling, or to identify further attack surfaces on the device. Confidentiality is impacted at a low level; integrity and availability are not directly affected (Apple macOS Tahoe Advisory, Apple macOS Sonoma Advisory).

Apple has released patches across all affected platforms. Users should update to the following versions or later: iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, macOS Tahoe 26.4, and visionOS 26.4. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. As an additional precaution, restricting app installation to trusted sources (App Store only) can reduce exposure to malicious apps that might exploit this vulnerability (Apple iOS 18.7.7 Advisory, Apple macOS Sequoia Advisory, Apple macOS Tahoe Advisory).

The vulnerability was part of a broader March 2026 Apple security update that addressed over 140 vulnerabilities across iOS, macOS, iPadOS, and visionOS, which received coverage from security news outlets and threat intelligence platforms. The SANS Internet Storm Center noted the update in a diary entry, and CIS published an advisory on multiple vulnerabilities in Apple products from this release cycle. Community reaction has been routine, with no significant controversy or elevated concern specific to CVE-2026-28880 given its medium severity and information-disclosure-only impact (SANS ISC, CIS Advisory).