Security readout for executives and security teams
Plain-English summary
Apple fixed a memory-safety flaw that could let an app unexpectedly terminate an affected device’s system. The supplied record rates it critical, but does not document data theft, code execution, or active exploitation. Devices not yet updated to Apple’s 26.6 operating-system releases should be treated as potentially exposed.
Executive priority
Prioritize prompt deployment of the 26.6 updates across supported Apple fleets, beginning with devices exposed to untrusted applications. The critical rating warrants urgency, while the presently documented impact is system termination rather than confirmed compromise. Track unsupported or update-ineligible assets separately because the supplied sources name no alternative fix.
Technical view
CVE-2026-28928 is a CWE-416 use-after-free addressed through improved memory management. Fixes are listed for iOS and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. Apple describes the demonstrated impact as unexpected system termination caused by an app. The affected component, vulnerable version boundaries, and technical exploit prerequisites are not supplied.
Likely exposure
Potential exposure includes Apple devices running releases earlier than the listed 26.6 fixes. The source bundle does not provide reliable minimum affected versions or identify the vulnerable component, so inventory comparisons cannot establish exposure more precisely. Prioritize devices permitting untrusted or lightly governed applications.
Exploitation context
The supplied record is not listed in KEV and provides no evidence of active exploitation. Apple’s stated scenario requires an app, which conflicts with the supplied CVSS network attack vector. Treat the vector as unverified until Apple or CVE authorities clarify the attack path.
Researcher notes
The record lacks a component name, crash details, vulnerable version ranges, and exploitation evidence. Its CVSS 9.8 vector claims network reachability without privileges or interaction, while Apple’s description says an app may trigger termination. Do not infer remote code execution or confidentiality impact from the vector alone; seek authoritative clarification before modeling exploitability.
Mitigation direction
- Update iPhones and iPads to iOS or iPadOS 26.6 or later.
- Update supported Macs to macOS Tahoe 26.6 or later.
- Update Apple TV and Apple Watch devices to their respective 26.6 releases.
- Restrict untrusted application installation where updates cannot be applied immediately.
- Check Apple security guidance for device-specific availability or additional mitigations.
Validation and detection
- Inventory operating-system versions across managed Apple devices.
- Confirm each supported device reports version 26.6 or later.
- Review management-console data for failed, deferred, or unavailable updates.
- Investigate unexplained system terminations associated with recently installed or updated apps.
- Recheck Apple advisories for clarified affected versions and attack prerequisites.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28928 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/128066CVE reference, apple
- https://support.apple.com/en-us/128067CVE reference, apple
- https://support.apple.com/en-us/128068CVE reference, apple
- https://support.apple.com/en-us/128069CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.