CVE-2026-28891: 
macOS vulnerability analysis and mitigation

CVE-2026-28891 is a race condition vulnerability in the NetAuth component of macOS that allows a sandboxed application to break out of its sandbox. It affects macOS Sonoma 14.0–14.8.4, macOS Sequoia 15.0–15.7.4, and macOS Tahoe 26.0–26.3. Apple disclosed and patched the issue on March 24, 2026, with fixes released in macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, and macOS Tahoe 26.4. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Apple Sequoia Advisory, Apple Tahoe Advisory, Apple Sonoma Advisory).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition), specifically within the NetAuth framework on macOS. A malicious application can exploit a time-of-check/time-of-use (TOCTOU)-style race condition during sandbox validation in NetAuth, allowing it to escape its sandbox containment. Apple addressed the issue by adding additional validation to close the race window. The reporter is listed as an anonymous researcher, and no public proof-of-concept or detailed technical write-up has been disclosed (Apple Sequoia Advisory, Apple Tahoe Advisory).

Successful exploitation allows a sandboxed application to break out of its macOS sandbox, potentially gaining access to system resources, sensitive user data, and network shares beyond its permitted scope. The CVSS scope is marked as "Changed," indicating the vulnerability can affect components outside the vulnerable component's security boundary. This could enable a malicious app to access protected files, user credentials, or perform actions with elevated privileges, significantly undermining macOS's application isolation model (Apple Sequoia Advisory, Apple Tahoe Advisory).

Apple has released patches addressing CVE-2026-28891 in macOS Sonoma 14.8.5, macOS Sequoia 15.7.5, and macOS Tahoe 26.4, all released on March 24, 2026. Users should update their macOS systems to these versions or later immediately via System Settings > Software Update. As a temporary workaround prior to patching, administrators should limit the installation of untrusted or third-party applications and monitor for suspicious process behavior originating from sandboxed apps (Apple Sonoma Advisory, Apple Sequoia Advisory, Apple Tahoe Advisory).

The CIS Security advisory noted that multiple vulnerabilities in Apple products patched in this release cycle could allow for privilege escalation, grouping CVE-2026-28891 among a broader set of March 2026 security fixes. The SANS Internet Storm Center published a diary entry covering the March 2026 Apple security updates. General community reaction was consistent with routine patch-cycle coverage, with no significant controversy or elevated concern specific to this CVE.