CVE-2026-28823

MEDIUM

macOS < 26.4 - Unprotected System File Deletion via Path Handling Issue

Title source: llm

Description

A path handling issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.4. An app with root privileges may be able to delete protected system files.

References (1)

Core 1

Core References

https://support.apple.com/en-us/126794

Scores

CVSS v3 4.9

EPSS 0.0029

EPSS Percentile 20.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284

Status published

Products (2)

Apple/macOS < 26.4

apple/macos 26.0 - 26.4

Published Mar 25, 2026

Tracked Since Mar 25, 2026