Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.2

Apple Devices: Unauthorized Access to Kernel State

CVE-2026-28867 · published 7 months ago
Summary

Some Apple devices can be vulnerable to a security risk if an attacker exploits a weakness in the way authentication works. This could potentially allow an app to gain access to sensitive information. Apple has released software updates to fix this issue, so it's essential to ensure all devices are running the latest version.

What to do
  • Update apple ios and ipados to version 18.7.7 or later.
  • Update apple tvos to version 26.4 or later.
  • Update apple visionos to version 26.4 or later.
  • Update apple watchos to version 26.4 or later.
Affected software
VendorProductAffected versions
apple ios and ipados < 18.7.7
apple macos < 15.7.5
>= 15.0, < 15.7.5
>= 26.0, < 26.4
apple tvos < 26.4
apple visionos < 26.4
apple watchos < 26.4
apple ipados < 18.7.7
>= 26.0, < 26.4
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
apple iphone_os < 18.7.7
>= 26.0, < 26.4
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Original advisory text
This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26....
This issue was addressed with improved authentication. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to leak sensitive kernel state.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.2 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published25 Mar 2026
Updated4 Nov 2026
First seen25 Mar 2026
Sources
CVE-2026-28867 · NVD
CVE-2026-28867 · MITRE
Track software like this
Free during beta