This vulnerability (CVE-2026-28840) in Apple macOS arises from a permissions issue that could enable an app to escalate its privileges to root. Apple has fixed the issue by implementing additional restrictions in the specified macOS versions: Sequoia 15.7.7, Sonoma 14.8.7, and Tahoe 26.4. The CVSS v3.1 base score is 7.8, indicating a high severity with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The weakness corresponds to CWE-269 (Improper Privilege Management). There is no vendor advisory explicitly linked, but the description confirms the fix availability in the listed versions.

Successful exploitation allows an application to gain root privileges on affected macOS systems, potentially leading to full system compromise including unauthorized access, modification, or destruction of data and system resources. This elevates the risk of complete control over the affected device.

Apply the official patches by upgrading to macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, or macOS Tahoe 26.4 where the issue is fixed. Since the vendor has released fixed versions, updating to these versions is the recommended remediation. No additional mitigations are specified or required beyond applying these updates.