Silent Apple Account Persistence in macOS Sonoma

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apple Inc.

Description

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-28836

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos_sonoma	14.8.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a correctness issue in macOS Sonoma that allows an attacker with physical access to silently persist an Apple Account on a device even after it has been erased. This means the account remains active and could potentially be used for unauthorized access.

Impact Analysis

If someone gains physical access to your device, they could exploit this flaw to keep your Apple Account active on an erased device. This could lead to unauthorized access to your data or services linked to that account.

Mitigation Strategies

Update to macOS Sonoma 14.8.8 or later to address the issue. Ensure devices are fully erased and verified before disposal or transfer.

Hi! I’m here to help you understand CVE-2026-28836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70