{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28864", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2026-03-03T16:36:03.973Z", "datePublished": "2026-03-25T00:35:43.723Z", "dateUpdated": "2026-10-26T20:44:36.391Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "A local attacker may gain access to user's Keychain items"}]}], "affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "0", "status": "affected", "lessThan": "18.7.7", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.7.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"version": "0", "status": "affected", "lessThan": "14.8.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.7.5", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "15.8.2", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "26.7.2", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"version": "0", "status": "affected", "lessThan": "26.4", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.7.5, macOS Sequoia 15.8.2, macOS Sonoma 14.8.5, macOS Tahoe 26.4, macOS Tahoe 26.7.2, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items."}], "references": [{"url": "https://support.apple.com/en-us/126792"}, {"url": "https://support.apple.com/en-us/126793"}, {"url": "https://support.apple.com/en-us/126794"}, {"url": "https://support.apple.com/en-us/126795"}, {"url": "https://support.apple.com/en-us/126796"}, {"url": "https://support.apple.com/en-us/126798"}, {"url": "https://support.apple.com/en-us/126799"}, {"url": "https://support.apple.com/en-us/149227"}, {"url": "https://support.apple.com/en-us/149522"}, {"url": "https://support.apple.com/en-us/149523"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-10-26T20:44:36.391Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:18:46.672912Z", "id": "CVE-2026-28864", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:20:25.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-28864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:18:46.672912Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:18:09.296Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "0", "lessThan": "18.7.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "14.8.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "15.7.5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "visionOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "0", "lessThan": "26.4", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/126792"}, {"url": "https://support.apple.com/en-us/126793"}, {"url": "https://support.apple.com/en-us/126794"}, {"url": "https://support.apple.com/en-us/126795"}, {"url": "https://support.apple.com/en-us/126796"}, {"url": "https://support.apple.com/en-us/126798"}, {"url": "https://support.apple.com/en-us/126799"}], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "A local attacker may gain access to user's Keychain items"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-08-17T21:31:41.834Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28864", "state": "PUBLISHED", "dateUpdated": "2026-08-17T21:31:41.834Z", "dateReserved": "2026-03-03T16:36:03.973Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2026-03-25T00:35:43.723Z", "assignerShortName": "apple"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "iOS and iPadOS", "vendor": "Apple", "versions": [{"lessThan": "18.7.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "macOS", "vendor": "Apple", "versions": [{"lessThan": "14.8.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.7.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "15.8.2", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.4", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "26.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "visionOS", "vendor": "Apple", "versions": [{"lessThan": "26.4", "status": "affected", "version": "0", "versionType": "custom"}]}, {"product": "watchOS", "vendor": "Apple", "versions": [{"lessThan": "26.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "118313FD-8CF6-4412-B1A8-4BC3D5C2F519", "versionEndExcluding": "18.7.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "matchCriteriaId": "F201257D-2F7C-43AA-BD51-ED5EC98F99E0", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "684E10EB-D01A-4E80-8764-B48B554B0B5E", "versionEndExcluding": "18.7.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7F08C35-7A60-4FEC-8D44-533902F43EDD", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "D66288AF-23BD-407A-81F5-F1DFBF84C622", "versionEndExcluding": "14.8.5", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD21D2C9-BBEC-4E8E-B8D2-C92B7E6155E1", "versionEndExcluding": "15.7.5", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F", "versionEndExcluding": "26.4", "versionStartIncluding": "26.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "matchCriteriaId": "113B9705-BFF0-4357-B1AB-F57052F32361", "versionEndExcluding": "26.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6EAF0A5-7CFF-4EF6-9BC7-DB25B213F753", "versionEndExcluding": "26.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.7.5, macOS Sequoia 15.8.2, macOS Sonoma 14.8.5, macOS Tahoe 26.4, macOS Tahoe 26.7.2, visionOS 26.4, watchOS 26.4. A local attacker may gain access to user's Keychain items."}, {"lang": "es", "value": "Este problema se abord\u00f3 con una comprobaci\u00f3n de permisos mejorada. Este problema est\u00e1 solucionado en iOS 18.7.7 y iPadOS 18.7.7, iOS 26.4 y iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. Un atacante local podr\u00eda obtener acceso a los elementos del Llavero del usuario."}], "id": "CVE-2026-28864", "lastModified": "2026-10-26T21:18:20.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:18:46.672912Z", "version": "2.0.3"}}]}, "published": "2026-03-25T01:17:10.453", "references": [{"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126792"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126793"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126794"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126795"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126796"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126798"}, {"source": "product-security@apple.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://support.apple.com/en-us/126799"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/149227"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/149522"}, {"source": "product-security@apple.com", "url": "https://support.apple.com/en-us/149523"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,18.7.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "iOS and iPadOS", "source": "cna", "vendor": "Apple"}, "product": "ios_and_ipados", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,14.8.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.7.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "macOS", "source": "cna", "vendor": "Apple"}, "product": "macos", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "visionOS", "source": "cna", "vendor": "Apple"}, "product": "visionos", "vendor": "apple"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "watchOS", "source": "cna", "vendor": "Apple"}, "product": "watchos", "vendor": "apple"}], "analysis": {"en": {"generated_at": "2026-03-25T19:55:58.928982+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest version of the affected operating system, such as iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, or watchOS 26.4.", "If an upgrade is not immediately possible, monitor the device for unexpected Keychain read operations and lock the device when not in use.", "Ensure that all users are aware of the importance of securing their device with a strong lock and not sharing access with untrusted parties."], "summary": {"action": "Patch", "impact": "Unauthorized Keychain Access"}, "threat_synthesis": {"affected_systems": "Apple iOS, iPadOS, macOS, visionOS, and watchOS. Versions affected include iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4.", "description_and_impact": "A local attacker can bypass permissions checking to access a user's Keychain items, exposing stored passwords, certificates, and other sensitive credentials. The weakness is a failure to properly enforce access control (CWE-863). The compromised data can lead to credential theft, further attacks, or unauthorized system access, affecting the confidentiality and integrity of user data.", "risk_and_exploitability": "The CVSS score of 3.3 indicates low severity, and the EPSS score is less than 1 percent, suggesting a very low probability of exploitation. The vulnerability is not listed in the KEV catalog. Because the attack requires local device access, it is most relevant to situations where an attacker can physically or remotely interact with the device while the user is logged in or has provided authentication. No public exploit is known, and the simplified fix is to update to the patched OS releases."}}}}, "created": "2026-03-25T11:35:46.064780+00:00", "title": "Local Keychain Access Exploit in Apple Operating Systems", "updated": "2026-03-25T21:16:02.490972+00:00", "vendors": ["apple", "apple$PRODUCT$ios_and_ipados", "apple$PRODUCT$macos", "apple$PRODUCT$visionos", "apple$PRODUCT$watchos"]}