CVE-2026-28836

Published: Sep 14, 2026Modified: Sep 18, 2026

6.1

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 0.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.

Affected (1)

Products: Apple: Macos

Apple

1 product

Macos

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	version < 14.8.8

Related CWEs

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

References (1)

https://support.apple.com/en-us/128072

Source: product-security@apple.com

Release NotesVendor Advisory

Timeline

No history available yet.