---
id: CVE-2026-28866
title: This issue was addressed with improved validation of symlinks
summary: >-
  This issue was addressed with improved validation of symlinks. This issue is
  fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia
  15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access
  sensi…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
vendor: Apple
product: iOS and iPadOS
affected:
  - ios_and_ipados < 18.7.7
  - ios_and_ipados < 26.4
  - macOS < 14.8.5
  - macOS < 15.7.5
  - macOS < 26.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-03-25T19:14:23.905982Z'
published: '2026-03-25'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T20:35:09.464Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-28866'
references:
  - url: 'https://support.apple.com/en-us/126792'
  - url: 'https://support.apple.com/en-us/126793'
  - url: 'https://support.apple.com/en-us/126794'
  - url: 'https://support.apple.com/en-us/126795'
  - url: 'https://support.apple.com/en-us/126796'
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15133
ingestedAt: '2026-10-26T20:39:42.540Z'
---

## Overview

This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.

## Affected

- `ios_and_ipados < 18.7.7`
- `ios_and_ipados < 26.4`
- `macOS < 14.8.5`
- `macOS < 15.7.5`
- `macOS < 26.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.