CVE-2026-28836 in macOS
Summary
by MITRE • 09/14/2026
A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability described involves a logical flaw within the authentication and account management subsystems of macOS, specifically affecting devices running versions prior to macOS Sonoma 14.8.8. This issue is categorized as a correctness error where the system fails to properly validate or clear state information during critical operational phases such as device erasure or factory reset procedures. In secure computing environments, it is imperative that any process intended to wipe user data and restore a device to its original out-of-box state also removes all associated authentication tokens, session keys, and persistent account bindings. The failure in this logic allows an attacker with physical access to the hardware to bypass these safeguards, resulting in the silent persistence of an Apple Account on a device that has ostensibly been erased.
From a technical perspective, this flaw likely stems from incomplete cleanup routines or race conditions within the Keychain Access services and iCloud synchronization daemons when handling deletion requests. When a user initiates a full disk erase, the operating system is responsible for destroying cryptographic keys associated with local accounts and ensuring that remote account associations are severed both locally and potentially via cloud-based revocation mechanisms. The deficiency in these checks means that residual metadata or cached authentication credentials remain intact on the storage medium despite the apparent wipe operation. This persistence occurs silently, meaning there may be no immediate visual indication to the user or administrator that an old account profile remains active and linked to the device hardware identifier.
The operational impact of this vulnerability is significant for organizations relying on mobile device management (MDM) solutions and strict data loss prevention policies. An attacker with physical access could exploit this flaw to maintain unauthorized remote access capabilities even after a device has been wiped, potentially allowing them to re-establish connections through iCloud services or other Apple ecosystem integrations. This undermines the fundamental security assumption that erasing a device renders it useless for tracking or surveillance purposes. It also poses risks in scenarios involving device recycling, resale, or return processes where sensitive corporate data might be assumed to have been purged but remains accessible via persistent account links.
This type of vulnerability aligns with CWE-613, which refers to Insufficient Session Expiration, and more broadly with CWE-209, the Generation of Error Message Containing Sensitive Information if the persistence leads to identifiable state leakage. In terms of attack vectors, it falls under MITRE ATT&CK technique T1534, Internal Spearphishing or Remote Access via trusted services, as well as aspects of physical access attacks described in T1078, Valid Accounts. The ability to persist an account after erasure effectively allows for long-term unauthorized presence on the system without triggering standard alerts associated with new login attempts.
Mitigation strategies primarily involve applying the vendor-provided software update available in macOS Sonoma 14.8.8 and later versions, which corrects the validation logic during the erase process to ensure complete removal of account states. For environments where immediate patching is not feasible, administrators should implement strict physical access controls to prevent unauthorized individuals from interacting with device hardware. Additionally, relying solely on local erasure may be insufficient; organizations should enforce remote wipe capabilities through MDM solutions that can actively revoke tokens and sever cloud-based associations independently of the local OS state. Regular audits of enrolled devices against active account lists can also help detect anomalies resulting from such persistence flaws before they lead to broader security compromises.