{"id":"CVE-2026-28853","kind":"vulnerability","aliases":["CVE-2026-28853"],"related":[],"title":"macOS: a local app can gain elevated privileges through a missing check","description":"The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.","summary":"Apple's macOS Sequoia and Tahoe have a flaw that lets an installed app raise its privileges on the Mac. The sources say only that Apple fixed it with improved checks and do not describe the exact code path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions below.\n- unknown","fix":"- Update macOS Sequoia to `15.8` or later.\n- Update macOS Tahoe to `26.7` or later.","status":"open","published_at":"2026-10-20T01:17:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:10+00:00","updated_at":"2026-10-25T03:10:10+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:10:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS Sequoia to `15.8` or later.\n- Update macOS Tahoe to `26.7` or later.","reach":"local","title":"macOS: a local app can gain elevated privileges through a missing check","impact":"high","summary":"Apple's macOS Sequoia and Tahoe have a flaw that lets an installed app raise its privileges on the Mac. The sources say only that Apple fixed it with improved checks and do not describe the exact code path.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A local app gains higher system privileges on the Mac.","analyst_note":"Check Apple's security notes for CVE-2026-28853 for the affected component and whether exploitation requires a particular app or entitlement.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed versions below.\n- unknown","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Any Mac running macOS Sequoia before 15.8 or macOS Tahoe before 26.7 is affected, since the attacker only needs an app running on the machine. The sources do not say which apps or configurations are required, so unknown beyond that. Teams on fully patched or managed macOS fleets with the fixed releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000584,"input_tokens":3251,"output_tokens":517,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-28853':15A,18A '15.8':76C '26.7':79C 'abl':84C 'address':65C 'app':4A,36B,81C 'appl':19B,23B,48B 'check':12A,53B,68C 'code':60B 'cve':13A,16A 'describ':57B 'elev':7A,86C 'endpoint':20B 'exact':59B 'fix':49B,72C 'flaw':31B 'gain':6A 'improv':52B,67C 'infrastructur':21B 'instal':35B 'issu':63C,70C 'let':33B 'local':3A 'mac':42B 'maco':1A,22B,25B,74C,77C 'may':82C 'miss':11A 'path':61B 'privileg':8A,39B,87C 'rais':37B 'say':45B 'sequoia':26B,75C 'sourc':44B 'taho':28B,78C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running macOS Sequoia before 15.8 or macOS Tahoe before 26.7 is affected, since the attacker only needs an app running on the machine. The sources do not say which apps or configurations are required, so unknown beyond that. Teams on fully patched or managed macOS fleets with the fixed releases can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28853","severity":null,"published_at":"2026-10-20T01:17:11+00:00","modified_at":"2026-10-21T04:18:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}