PT-2026-39777 · Apple · Macos Tahoe+1

Guluisacat + 4 · Published 2026-03-24 · Updated 2026-05-24 · CVE-2026-28910

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions macOS Tahoe versions prior to 26.4

Description A flaw in the Archive Utility allows a malicious application to bypass the App Sandbox data containers, Transparency, Consent, and Control (TCC), and code signing. This can lead to the hijacking of applications and provide unauthorized access to arbitrary files across the full file system. The issue stems from insufficient permissions checking.

Recommendations Update to macOS Tahoe 26.4.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-28910

Affected Products

Apple Macos

Macos Tahoe

References · 10

• https://support.apple.com/en-us/126794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28910 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28910 · Note
• https://twitter.com/blackstormsecbr/status/2057811338324214087 · Twitter Post
• https://twitter.com/mysk_co/status/2057851378567909748 · Twitter Post
• https://twitter.com/patch1t/status/2056997818292986359 · Twitter Post
• https://twitter.com/spuluka/status/2058119201189974404 · Twitter Post
• https://t.me/cveNotify/163303 · Telegram Post
• https://t.me/proxy_bar/3405 · Telegram Post
• https://twitter.com/akaclandestine/status/2058503994931032558 · Twitter Post