CVE-2026-28906
Estado: AnalizadaAlta (7.5)—
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.50%
- Percentil entre todas las CVEs puntuadas: 41
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access75 % - Impacto principal
T1040Network Sniffingcredential access · discovery70 %
AV:N/PR:N/UI:N indica explotación remota sin autenticación (T1190). CWE-359 (Privacy Violation) y descripción de seguimiento de IP sugieren captura de tráfico de red (T1040).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (4)
CWE
- CWE-359
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-28906",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-28906",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-05-12T17:48:40.167918Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "product-security@apple.com",
"affectedData": [
{
"vendor": "Apple",
"product": "iOS and iPadOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "18.7.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "26.5",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "macOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "14.8.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "15.7.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "26.5",
"versionType": "custom"
}
]
},
{
"vendor": "Apple",
"product": "visionOS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "26.5",
"versionType": "custom"
}
]
}
]
}
],
"published": "2026-05-11T21:18:53.403",
"references": [
{
"url": "https://support.apple.com/en-us/127110",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/127111",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/127115",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/127116",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/127117",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/127120",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "product-security@apple.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-359"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address."
}
],
"lastModified": "2026-06-17T10:29:19.270",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3968B76-E6DE-416D-A0FB-E4833FFAAE0F",
"versionEndExcluding": "18.7.9"
},
{
"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20644D7E-2AB6-48CA-AED4-C474A9867986",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6431EAF-B395-4C19-9AB6-A2F45991C897",
"versionEndExcluding": "18.7.9"
},
{
"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BE54A3B-D667-43BA-AB71-BCF8438054E0",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD9E7FAE-30DA-4B2B-A63A-6DFEA7A29933",
"versionEndExcluding": "14.8.7",
"versionStartIncluding": "14.0"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2984C440-3DC2-413A-B5FA-1FAB21078DB8",
"versionEndExcluding": "15.7.7",
"versionStartIncluding": "15.0"
},
{
"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CB91417-90A8-4A9B-A1D0-1D94B80EF837",
"versionEndExcluding": "26.5",
"versionStartIncluding": "26.0"
},
{
"criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C8F45D80-0DF8-444E-9AF1-703A1075F046",
"versionEndExcluding": "26.5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "product-security@apple.com"
}