Security readout for executives and security teams
Plain-English summary
Apple fixed a flaw in macOS where an app that is supposed to stay inside its sandbox could break out and access parts of the system it should not. Apple addressed it by tightening the sandbox rules. Updating to the patched macOS versions removes the risk; unpatched Macs remain exposed if a malicious or buggy app runs locally.
Executive priority
Schedule patching during the next maintenance window for managed Macs, prioritizing developer, executive, and high-value endpoints. Not an emergency on its own, but sandbox escapes are commonly chained with other flaws, so do not let it slip past the cycle.
Technical view
CVE-2026-28838 is an improper access control issue (CWE-284) in the macOS app sandbox that permits a sandboxed application to escape its confinement. Apple resolved it by adding sandbox restrictions in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4. CVSS 3.1 base score is 5.3 with confidentiality impact only (C:L/I:N/A:N). No vulnerable component, exploit, or attribution detail is published in the cited advisories.
Likely exposure
Any Mac running macOS Sequoia before 15.7.5, macOS Sonoma before 14.8.5, or macOS Tahoe before 26.4. Risk is highest where users install third-party or unsigned apps, run sandboxed apps with sensitive data, or have weak app-installation controls.
Exploitation context
No public reports of in-the-wild abuse and the CVE is not on CISA KEV. Apple credits the fix to internal restrictions rather than active attack pressure. Sandbox-escape bugs are often combined with a separate initial-access flaw (e.g., a malicious app or browser exploit) rather than used alone.
Researcher notes
CWE-284 (Improper Access Control) with CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Apple's advisory describes only that additional sandbox restrictions were added; no technical detail, PoC, or attribution is provided in the bundle. The AV:N vector is unusual for a local sandbox escape and likely reflects Apple's standard scoring rather than a true remote vector. Treat sandbox escapes as a chain component when triaging alongside other Apple advisories of the same release.
Mitigation direction
- Update macOS to Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 across the fleet.
- Enable automatic security updates in System Settings or via MDM policy.
- Restrict installation of unsigned or untrusted apps using Gatekeeper and MDM allowlists.
- Confirm endpoint detection tooling is current and reporting on the affected macOS versions.
- Remind users to install apps only from the App Store or known vendors until patched.
Validation and detection
- Inventory macOS endpoints and identify hosts on Sequoia <15.7.5, Sonoma <14.8.5, or Tahoe <26.4.
- Verify build numbers via MDM reporting or 'About This Mac' after deployment.
- Confirm Software Update policy and Rapid Security Response are enforced via MDM.
- Track patch compliance over 7, 14, and 30 days and escalate stragglers.
- Review Apple advisories 126794/126795/126796 for any updated guidance or related CVEs.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28838 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/126794CVE reference, apple
- https://support.apple.com/en-us/126795CVE reference, apple
- https://support.apple.com/en-us/126796CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.