Security readout for executives and security teams
Plain-English summary
Apple fixed a flaw that let an app secretly see the full list of other apps installed on a user's iPhone, iPad, Mac, or Vision Pro. This is a privacy leak, not remote takeover, but the inventory data helps attackers profile users for targeted phishing or social engineering. Updating to the March 2026 Apple releases closes the gap.
Executive priority
Schedule a routine patch cycle for managed Apple fleets. Not an emergency, but the disclosure surface aids targeted profiling and phishing follow-on attacks.
Technical view
A permissions/access-control weakness (CWE-284) in iOS, iPadOS, macOS Tahoe, and visionOS before the 26.4 train allowed a local app to enumerate the user's installed application inventory without authorization. CVSS 3.1 6.2 (AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects local attack vector with high confidentiality impact and no integrity or availability effect. Apple addressed it with additional sandbox restrictions in the 26.4 releases.
Likely exposure
Any Apple endpoint running pre-26.4 iOS, iPadOS, macOS Tahoe, or visionOS that installs third-party apps is exposed. The largest population is BYOD and corporate-managed iPhones, iPads, and Macs that have not yet received the March 2026 update train.
Exploitation context
No active exploitation is cited in the bundle and the CVE is not listed in CISA KEV. The flaw requires a local app context (AV:L) with no privileges or user interaction, so a malicious or compromised app already on the device is the realistic abuse path.
Researcher notes
CWE-284 (Improper Access Control) with CVSS 6.2 AV:L/AC:L/PR:N/UI:N and C:H/I:N/A:N — pure confidentiality impact from a local context. Apple's advisory language ("permissions issue addressed with additional restrictions") suggests a sandbox or entitlement check tightening rather than a kernel fix. No exploit PoC or attribution is named in the bundle; researchers should consult the three Apple HT pages for the full per-platform component breakdown.
Mitigation direction
- Update Apple devices to iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, or visionOS 26.4.
- Enforce minimum-OS compliance policies in MDM (Intune, Jamf, Kandji) for corporate Apple devices.
- Restrict installation of unvetted third-party apps via App Store and managed app catalogs.
- Review privacy-sensitive apps and remove ones that do not need broad device inventory access.
- Monitor Apple security advisories at the linked support pages for related follow-up fixes.
Validation and detection
- Inventory Apple OS versions via MDM and flag devices below 26.4.
- Confirm the Apple advisories (HT126792, HT126794, HT126799) list CVE-2026-28833 in the fixed components.
- Audit MDM compliance reports after a patch window to verify update adoption.
- Spot-check high-risk users (executives, finance) for prompt update status.
- Review installed-app telemetry for unsanctioned apps that could abuse the pre-patch behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28833 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N2.53.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/126792CVE reference, apple
- https://support.apple.com/en-us/126794CVE reference, apple
- https://support.apple.com/en-us/126799CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.