CVE-2026-28817
Published: 25 March 2026
Summary
CVE-2026-28817 is a high-severity Race Condition (CWE-362) vulnerability in Apple Macos. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Reference monitor enforces complete mediation of all sandbox access decisions, preventing race condition exploits that circumvent restrictions through flawed state handling.
Process isolation maintains distinct execution domains for sandboxed processes, directly mitigating race-based escapes from sandbox confines.
Access enforcement implements sandbox policies with robust state handling to block unauthorized access attempts exploiting race conditions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in macOS sandbox state handling directly enables exploitation of a software vulnerability to bypass sandbox restrictions and escalate privileges (T1068).
NVD Description
A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. A sandboxed process may be able to circumvent sandbox restrictions.
Deeper analysisAI
CVE-2026-28817 is a race condition vulnerability (CWE-362) addressed through improved state handling in macOS. It affects macOS Sequoia versions prior to 15.7.5, macOS Sonoma prior to 14.8.5, and macOS Tahoe prior to 26.4. The flaw enables a sandboxed process to circumvent sandbox restrictions, earning a CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
A local attacker can exploit this vulnerability with no privileges required, though it demands high attack complexity and no user interaction. Successful exploitation allows the sandboxed process to escape its restrictions, potentially granting elevated access and resulting in high impacts to confidentiality, integrity, and availability due to the changed scope.
Apple's security advisories detail the mitigation, confirming the issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 via enhanced state handling. Relevant updates are documented at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796.
Details
- CWE(s)