CVE-2026-28937

CVE-2026-28937 is a state-management flaw in Apple macOS that can allow an app running on a Mac to access sensitive user data that it should not be permitted to read. The issue is triggered locally: an attacker would need to get a malicious app onto the victim's machine, or abuse an already-installed app, rather than attacking the system remotely over a network. Successful abuse results in unauthorized access to sensitive user information — a privacy/information-disclosure impact — not remote code execution. The flaw affects Macs running macOS versions prior to the fix; Apple addressed it through improved state management and shipped the patch in macOS Golden Gate 27 as part of a broad September software update. CVSS has not yet been scored, no public proof-of-concept is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Update to macOS Golden Gate 27 or later via System Settings > General > Software Update as soon as possible, and have IT admins expedite deployment across managed Mac fleets. Because the flaw is app-mediated, review and restrict permissions granted to third-party apps and avoid installing untrusted software. No configuration workaround is documented, so patching is the primary mitigation.