Security readout for executives and security teams
Plain-English summary
Apple devices can suffer kernel memory corruption when connecting to a malicious NFS server. Because the flaw affects privileged operating-system code, successful exploitation could seriously compromise confidentiality, integrity, and availability. Apple addressed it through improved bounds checking in version 26.6 releases.
Executive priority
Treat remediation as urgent for Apple systems using NFS, especially where servers are untrusted or externally influenced. Accelerate deployment of Apple’s 26.6 updates and verify completion. Systems without NFS exposure remain important to update, but evidence supports prioritizing devices that can connect to malicious NFS infrastructure.
Technical view
CVE-2026-28931 is a CWE-120 buffer overflow in Apple’s NFS-related kernel processing. A malicious NFS server can trigger kernel memory corruption without privileges or user interaction, according to the supplied CVSS 3.1 vector. The sources do not establish code execution or describe the precise affected version range.
Likely exposure
Potentially exposed systems are iOS, iPadOS, macOS, tvOS, and watchOS devices below the named 26.6 fixes that connect to untrusted or compromised NFS servers. The supplied affected-version value is incomplete, so administrators should confirm applicability through Apple’s advisories and device inventories.
Exploitation context
The supplied record does not report active exploitation, and the CVE is not identified as being in KEV. Exploitation requires the target to connect to a malicious NFS server. No public exploit availability or observed attack activity is established by the provided sources.
Researcher notes
The record attributes the issue to insufficient bounds checking and identifies CWE-120. The stated outcome is kernel memory corruption; stronger impacts such as reliable code execution are not confirmed. CVSS 9.8 indicates network reachability, low complexity, no privileges, and no user interaction, but the exact vulnerable code path and affected-version floor are absent.
Mitigation direction
- Upgrade affected iPhones and iPads to iOS or iPadOS 26.6.
- Upgrade affected Macs to macOS Tahoe 26.6.
- Upgrade affected Apple TV and Apple Watch devices to their 26.6 releases.
- Check Apple advisories for model eligibility and any additional vendor guidance.
- Prioritize devices permitted to connect to untrusted NFS servers.
Validation and detection
- Inventory Apple device models, operating-system versions, and NFS usage.
- Confirm each in-scope device reports the applicable 26.6 release or newer.
- Review network controls and telemetry for connections to unknown NFS servers.
- Recheck Apple advisories for clarified affected-version ranges or updated guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28931 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/128066CVE reference, apple
- https://support.apple.com/en-us/128067CVE reference, apple
- https://support.apple.com/en-us/128068CVE reference, apple
- https://support.apple.com/en-us/128069CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.