Security readout for executives and security teams
Plain-English summary
A weakness in Apple operating systems’ authentication state handling may let an attacker controlling a privileged network position intercept traffic. Apple has released fixes across its major platforms. Risk is greatest for devices using networks where an attacker could control or manipulate traffic. The supplied evidence does not establish active exploitation.
Executive priority
Treat this as a high-priority patching issue, particularly for mobile or remote devices regularly connecting through untrusted networks. Expedited remediation is appropriate because exploitation needs no victim interaction, although it does require network positioning. There is no supplied evidence of active exploitation, and exact vulnerable ranges remain incomplete.
Technical view
CVE-2026-28865 is classified as CWE-285 with CVSS 3.1 score 7.5. The vector indicates network access, low complexity, no privileges, no user interaction, and high availability impact. Apple attributes the issue to authentication state management. Detailed protocol, component, and affected-version ranges are not disclosed in the bundle.
Likely exposure
Potential exposure includes iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices below the stated fixed releases. The supplied affected-version entries contain placeholder values, so precise vulnerable version ranges cannot be determined. Devices frequently using untrusted or attacker-influenced networks deserve priority.
Exploitation context
Exploitation requires a privileged network position, according to Apple’s description. The bundle reports that this could permit network-traffic interception but provides no technical prerequisites or demonstrated attack details. The CVE is not listed as KEV, and no cited source in the bundle reports active exploitation.
Researcher notes
The public description is sparse. It does not identify the affected component, protocol, or authentication-state failure. There is also an unresolved evidence gap: the narrative mentions traffic interception, while the CVSS vector records no confidentiality or integrity impact and high availability impact. Avoid inferring broader consequences without additional vendor detail.
Mitigation direction
- Update iOS and iPadOS to 18.7.7, 26.4, or an applicable later release.
- Update Sonoma to 14.8.5, Sequoia to 15.7.5, and Tahoe to 26.4 or later.
- Update tvOS, visionOS, and watchOS to 26.4 or later.
- Until patched, reduce device use on untrusted or attacker-controlled networks where operationally feasible.
- Check Apple guidance for supported branches or devices not covered by the listed releases.
Validation and detection
- Inventory affected Apple device families and their installed operating-system versions.
- Confirm every device meets the applicable fixed release listed by Apple.
- Use device-management reporting to identify failed, deferred, or incomplete updates.
- Recheck Apple advisories for revised affected-version details or additional releases.
- Document exceptions and reassess devices exposed to untrusted or privileged intermediary networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28865 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/126792CVE reference, apple
- https://support.apple.com/en-us/126793CVE reference, apple
- https://support.apple.com/en-us/126794CVE reference, apple
- https://support.apple.com/en-us/126795CVE reference, apple
- https://support.apple.com/en-us/126796CVE reference, apple
- https://support.apple.com/en-us/126797CVE reference, apple
- https://support.apple.com/en-us/126798CVE reference, apple
- https://support.apple.com/en-us/126799CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.