CVE-2026-28833 Apple CVE debrief

Who should care

Apple device administrators, mobile and endpoint security teams, privacy-focused organizations, and users running affected iPhone, iPad, Mac, or Vision Pro systems.

Technical summary

The record describes a permissions issue that was addressed with additional restrictions. According to the supplied NVD metadata, the weakness allows a local app to enumerate installed apps, which can expose sensitive device/application state. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and the affected ranges in the supplied CPE data end before 26.4 for iOS, iPadOS, and visionOS, with macOS affected from 26.0 through versions before 26.4.

Defensive priority

Moderate. Prioritize updating because the issue exposes potentially sensitive app-presence information, but the supplied data indicates a confidentiality-only impact and no evidence of active exploitation in the provided corpus.

Recommended defensive actions

• Upgrade affected Apple devices to iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, or visionOS 26.4 as applicable.
• Inventory Apple endpoints to identify devices still running versions before the fixed releases, especially managed devices.
• Treat the issue as a privacy exposure: review whether installed-app visibility could increase risk for sensitive or regulated workflows.
• Use standard endpoint hardening and app governance while updates are rolled out, but do not rely on controls other than the vendor fix to address the underlying issue.
• Monitor Apple security advisories and NVD updates for any follow-on clarifications or related fixes.

Evidence notes

This debrief is based only on the supplied CVE/NVD record metadata and the Apple support references listed in the source corpus. The CVE description states that a permissions issue was addressed with additional restrictions and that an app may be able to enumerate a user's installed apps. The supplied NVD metadata provides the CVSS vector and affected CPE version ranges, and the Apple reference links indicate the fixed releases. No exploit details are included or inferred beyond the cited record.

Official resources