PT-2026-39777 · Apple · Macos Tahoe+1

Guluisacat + 4 · Published 2026-03-24 · Updated 2026-05-31 · CVE-2026-28910

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS Tahoe versions prior to 26.4

Description An issue in the macOS Archive Utility allows a malicious application to access arbitrary files by breaking App Sandbox Data Containers and Transparency, Consent, and Control (TCC). The flaw enables an attacker to swap a signed application's executable on disk to bypass code signing protections. Exploitation requires the victim to execute an attacker-provided shell script and be deceived into performing a drag-and-drop action.

Recommendations Update macOS Tahoe to version 26.4.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-28910

Affected Products

Apple Macos

Macos Tahoe

References · 14

• https://support.apple.com/en-us/126794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28910 · Security Note
• https://twitter.com/HostileSpectrum/status/2060347479791390913 · Twitter Post
• https://twitter.com/mysk_co/status/2057851378567909748 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28910 · Note
• https://twitter.com/spuluka/status/2058119201189974404 · Twitter Post
• https://twitter.com/blackstormsecbr/status/2057811338324214087 · Twitter Post
• https://twitter.com/iAnonymous3000/status/2061131885452108090 · Twitter Post
• https://twitter.com/akaclandestine/status/2058503994931032558 · Twitter Post
• https://t.me/cveNotify/163303 · Telegram Post
• https://twitter.com/mysk_co/status/2059998046679875866 · Twitter Post
• https://t.me/proxy_bar/3405 · Telegram Post
• https://twitter.com/bob_burrough/status/2060410921017831662 · Twitter Post
• https://twitter.com/patch1t/status/2056997818292986359 · Twitter Post