CVE-2026-28827
Published: 25 March 2026
Summary
CVE-2026-28827 is a critical-severity Path Traversal (CWE-22) vulnerability in Apple Macos. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-28827 is a parsing vulnerability in the handling of directory paths, stemming from inadequate path validation (CWE-22). It affects macOS Sequoia prior to version 15.7.5, macOS Sonoma prior to 14.8.5, and macOS Tahoe prior to 26.4, enabling a malicious app to escape its sandbox confinement.
The vulnerability carries a CVSS v3.1 base score of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating exploitation by a local attacker with no privileges or user interaction required. Successful exploitation allows the app to achieve high-impact confidentiality, integrity, and availability violations across the system due to the changed scope from sandbox breakout.
Apple security advisories detail the fix through improved path validation, with patches available in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. Relevant updates are documented at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15097
Vulnerability details
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to break out of its sandbox.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CWE-22) in macOS app sandbox directly enables sandbox escape, mapping to exploitation for privilege escalation with full system scope change.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the path parsing vulnerability by requiring validation of directory path inputs to prevent sandbox escape.
Ensures timely identification, reporting, and patching of flaws like inadequate path validation in macOS sandbox handling.
Enforces process isolation through separate execution domains, containing malicious apps within sandboxes despite path traversal attempts.