HowToFixMe
● High · CVSS 7.5

How to Fix CVE-2026-28974: Improper Access Control DoS in Apple iOS, macOS and watchOS

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-05-25

CVE-2026-28974 is an improper access control flaw (CWE-284) that Apple disclosed across its entire operating-system line: iOS, iPadOS, macOS, tvOS, visionOS and watchOS. A malicious or compromised app slips past a permission check it should not, and Apple states the result is that the app may be able to cause a denial-of-service. The fix is an OS update, not a config tweak. If you are on iOS or iPadOS, move to 26.5; on macOS, 15.7.7 (Sequoia) or 26.5 (Tahoe); and 26.5 on tvOS, visionOS and watchOS. The rest of this page walks through checking your build, installing the right update on each device type, what to do on managed fleets, and how to confirm the patch actually landed.

⚡ At a glance
ProductApple iOS, iPadOS, macOS, tvOS, visionOS, watchOS
SeverityCVSS 3.1 base 7.5 (High) · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Actively exploited?No — not on CISA KEV; CISA SSVC Exploitation: none
AffectediOS/iPadOS < 26.5; macOS Sequoia < 15.7.7; macOS Tahoe < 26.5; tvOS < 26.5; visionOS < 26.5; watchOS < 26.5
Fixed iniOS/iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5
Type (CWE)CWE-284 Improper Access Control
Attacker requirementA malicious or compromised app installed on the device

Exploitation status

CVE-2026-28974 has not (yet) been flagged on the CISA Known Exploited Vulnerabilities catalog; treat that as 'no confirmed exploitation on record', not 'safe to ignore'. Take that with caution, because KEV entries often appear well after attacks begin, so patch on severity rather than holding out for a listing.

Public exploit availability: the references currently cite no public exploit or Metasploit module. That is not evidence of safety, since private exploit code may exist, so do not treat it as low risk for that reason alone.

Authoritative references:

What is CVE-2026-28974?

This is an access-control bug that lives inside Apple's operating systems rather than in any one app you install. In plain terms, some operation on the device was reachable without the permission check that should have gated it. Apple's own wording is short and precise: the issue "was addressed with improved checks to prevent unauthorized actions," and "an app may be able to cause a denial-of-service." That phrasing tells you two useful things. First, the trigger is an app already running on the device, so this is a local-app problem, not a remote attacker on the internet poking an exposed port. Second, the missing check let that app do something it was never authorized to do.

The weakness is classified as CWE-284, Improper Access Control. That category covers any case where software fails to properly restrict who, or what, is allowed to perform an action. Here, a sandboxed third-party app or a piece of malware that has tricked its way onto the device exercises a code path that the OS should have blocked, and the downstream effect Apple documents is a denial-of-service: the targeted function, process, or in some scenarios the device, stops behaving normally.

One detail is worth calling out because it can confuse readers who only glance at the score. The CVSS 3.1 vector CISA attached is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — a network attack vector with a high confidentiality impact. Apple's plain-language description, by contrast, frames the consequence as a denial-of-service triggered by an app. Both come straight from the source record. In practice, read the precondition the way Apple wrote it: an app on the device is what sets the bug off. The numeric vector is CISA's enrichment and is what drives the 7.5 High rating shown above. The same root issue was patched simultaneously across iOS and iPadOS, both current macOS trains, tvOS, visionOS and watchOS, which is why the fix list spans so many builds.

Why this CVE matters

A missing access-control check is rarely the whole attack. It is a step in one. An app that can perform an unauthorized action it should not have access to is exactly the kind of primitive a malicious developer or a piece of malware chains into something larger — degrading a service, knocking out a security feature, or softening the device for the next bug in a chain. The denial-of-service outcome Apple names is the visible symptom; the underlying problem is that the boundary between an app and the system was thinner than it should have been.

What makes this one broad rather than deep is the reach. The same flaw shipped in iPhones and iPads, in both the Sequoia and Tahoe macOS lines, on Apple TV, on Vision Pro and on the Apple Watch. If you manage a mixed Apple fleet, that means more than one update train to track. The good news is the threat-intelligence picture is calm: CISA's SSVC assessment marks Exploitation as none, the CVE is not on the Known Exploited Vulnerabilities catalog, and no public exploit is referenced. So this is a patch-on-your-normal-cadence item, not a drop-everything emergency — but "normal cadence" for a 7.5 High still means weeks, not months.

Am I affected?

You are affected if any Apple device you own or manage is running a build below the fixed version for its platform. Because there is no command line to query on a stock iPhone or Apple Watch, you check the version in Settings and compare it against the fixed builds.

On a Mac you can also read the build from the terminal, which is handy for scripting an audit across several machines:

# macOS only: print the product version and compare against the fixed build
sw_vers --productVersion        # e.g. 15.7.6  -> below 15.7.7, affected
# 15.7.7 (Sequoia) or 26.5 (Tahoe) and above are fixed

How to fix CVE-2026-28974

There is no patch to compile and no package to bump. The fix is the Apple software update for each device, and every affected platform got its build the same day. Install the version named for that device and you are done. Here is the per-device path.

iPhone and iPad (iOS / iPadOS 26.5)

  1. Open Settings → General → Software Update.
  2. If iOS 26.5 (or iPadOS 26.5) is offered, tap Update Now. Keep the device on Wi-Fi and charging.
  3. The phone reboots into the new build. After it comes back, re-open Software Update and confirm it reports the system is up to date.

To make this stick on personal devices, turn on Settings → General → Software Update → Automatic Updates so future security builds install overnight.

Mac (macOS Sequoia 15.7.7 or macOS Tahoe 26.5)

  1. Apple menu → System Settings → General → Software Update.
  2. If you are on the Sequoia line, install 15.7.7. If you are on the Tahoe line, install 26.5. macOS picks the right one for your train.
  3. Let the Mac restart to finish the install.

From the terminal you can both trigger and verify the update on a Mac:

# Install all recommended updates and restart if required (run with sudo)
sudo softwareupdate -i -a -R

# Confirm the resulting build
sw_vers --productVersion     # expect 15.7.7 (Sequoia) or 26.5 (Tahoe) or higher

Apple TV, Apple Watch and Vision Pro (26.5)

Managed fleets (MDM)

If you run devices through Jamf, Microsoft Intune, Kandji, or another MDM, push the update rather than trusting users to tap it. Use a managed software update / declarative device-management command that targets the fixed builds (iOS/iPadOS 26.5, macOS 15.7.7 or 26.5, tvOS/visionOS/watchOS 26.5) and set an enforcement deadline. Confirm the rollout from your MDM inventory by filtering for devices still reporting an OS version below the fixed build, and chase the stragglers.

There is no firmware image to flash and no commit hash to cherry-pick — the vendor update is the entire remediation.

If you can't patch immediately

Apple ships no standalone workaround for CVE-2026-28974; the OS update is the only real fix. If a device genuinely cannot be updated right now — a Mac mid-project, a kiosk iPad on a maintenance freeze — reduce exposure with these grounded steps:

None of these remove the flaw. They shrink the window in which a malicious app could reach it.

How to verify the fix worked

Verification here is a version check, not a scan. Confirm each device reports a build at or above the fixed release for its platform.

# macOS: one-line pass/fail against the Sequoia fixed build
v=$(sw_vers --productVersion)
echo "Installed: $v"   # 15.7.7 / 26.5 or higher = patched for CVE-2026-28974

On a managed fleet, the authoritative check is your MDM inventory: pull a report of OS versions and confirm no enrolled device still sits below the fixed build. Once every device reads the patched version, CVE-2026-28974 is closed for that device — there is no separate service to restart.

Frequently asked questions

Is CVE-2026-28974 being exploited in the wild?

No. It is not on CISA's KEV catalog, and CISA's SSVC assessment records Exploitation as none at the time of writing. No public exploit or Metasploit module is linked in the references. Patch on a normal severity-based schedule, and re-prioritise if the exploitation picture changes.

Which Apple versions fix CVE-2026-28974?

Apple fixed it in iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5 and watchOS 26.5. Any build below those on the matching platform is affected.

What can an attacker actually do with this bug?

Apple describes the impact as an app being able to cause a denial-of-service, fixed with improved checks to prevent unauthorized actions. It is an improper access control flaw (CWE-284): an app already on the device exercises an action that a missing permission check should have blocked. It is not a remote, no-app drive-by, despite the network-vector CVSS string CISA assigned.

Do I need to do anything beyond installing the Apple update?

For most people, no — install the OS update and restart. Because the bug is reached through an installed app, it is worth reviewing which third-party apps you actually trust. On managed fleets, push the update through MDM with an enforcement deadline so devices below the fixed build are forced to upgrade.

Additional nearby issues sensible to fix in the same maintenance window:

References

Assembled from Apple's official security advisories, the MITRE CVE record, and CISA's ADP/SSVC enrichment on 2026-05-25. This CVE is not currently in the CISA KEV catalog. Always confirm against the vendor advisory before applying changes in production.