Apple macOS: Privilege escalation via AMD component
Summary
A flaw in the AMD component of macOS Sequoia and macOS Tahoe allows a local app to elevate its privileges. An attacker first needs code running on the Mac, typically through a malicious or compromised app, so the flaw is not remotely exploitable from the internet. Apple fixed it with improved checks in macOS Sequoia 15.8 and macOS Tahoe 26.7. The CVSS 3.1 base score is 7.8 (high).
Affected
- macOS Sequoia before 15.8
- macOS Tahoe before 26.7
Fixed in
- macOS Sequoia 15.8
- macOS Tahoe 26.7
Workaround
Unknown. Apple has not published a workaround; apply the update.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed in the CISA KEV catalogue (per OpenCVE).
- No public proof of concept found; this is not conclusive.
Our recommendation
- Update all Macs to macOS Sequoia 15.8, macOS Tahoe 26.7 or later via MDM or manual patching.
- Verify the macOS version on every Mac.
- Use standard user accounts without admin rights and enforce app allow-listing.
- Monitor for unexpected privilege changes and unknown apps.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of macOS Tahoe 26.7 support.apple.com
- Apple Security Content of macOS Sequoia 15.8 support.apple.com
- OpenCVE: CVE-2026-28853 app.opencve.io
- VulDB: CVE-2026-28853 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:36.
Original description (NVD)
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.