Apple macOS up to 14.8.6/15.7.6/26.4 path traversal

Summaryinfo

A vulnerability was found in Apple macOS up to 14.8.6/15.7.6/26.4. It has been classified as critical. Impacted is an unknown function. Performing a manipulation results in Local Privilege Escalation. This vulnerability is cataloged as CVE-2026-28915. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apple macOS up to 14.8.6/15.7.6/26.4. This affects an unknown code block. The manipulation with an unknown input leads to a local privilege escalation vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able to gain root privileges.

The advisory is shared at support.apple.com. This vulnerability is uniquely identified as CVE-2026-28915 since 03/03/2026. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/18/2026). MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 14.8.7, 15.7.7 or 26.5 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• macOS

Version

• 14.8.0
• 14.8.1
• 14.8.2
• 14.8.3
• 14.8.4
• 14.8.5
• 14.8.6
• 15.7.0
• 15.7.1
• 15.7.2
• 15.7.3
• 15.7.4
• 15.7.5
• 15.7.6
• 26.0
• 26.1
• 26.2
• 26.3
• 26.4

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion