# Sequoia 15.7.5 Sequoia 15.7.5, released March 24, 2026, fixes 60 CVEs in Sequoia. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/macos/sequoia-15.7.5 - Platform: macOS - Released: Mar 24, 2026 - Priority: Urgent (Closes CVE-2026-28827, rated Critical) - CVEs: 60, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.apple.com/en-us/126795 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sequoia](https://patchblox.com/security/data/product/macos/sequoia.md) | | 15.7.5 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-28827](https://patchblox.com/security/data/cve/CVE-2026-28827.md) | Urgent | NetFSFramework: An app may be able to break out of its sandbox | 9.3 | 0.0029 | | | [CVE-2026-20688](https://patchblox.com/security/data/cve/CVE-2026-20688.md) | Urgent | Printing: An app may be able to break out of its sandbox | 9.3 | 0.0029 | | | [CVE-2025-58098](https://patchblox.com/security/data/cve/CVE-2025-58098.md) | High | Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... | 8.3 | 0.0153 | | | [CVE-2025-59775](https://patchblox.com/security/data/cve/CVE-2025-59775.md) | High | Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF | 7.5 | 0.0088 | | | [CVE-2025-65082](https://patchblox.com/security/data/cve/CVE-2025-65082.md) | High | Apache HTTP Server: CGI environment variable override | 7.5 | 0.0087 | | | [CVE-2026-28865](https://patchblox.com/security/data/cve/CVE-2026-28865.md) | High | 802.1X: An attacker in a privileged network position may be able to intercept network traffic | 7.5 | 0.0079 | | | [CVE-2025-66200](https://patchblox.com/security/data/cve/CVE-2025-66200.md) | High | Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo | 7.5 | 0.0070 | | | [CVE-2026-28894](https://patchblox.com/security/data/cve/CVE-2026-28894.md) | High | Calling Framework: A remote attacker may be able to cause a denial-of-service | 7.5 | 0.0069 | | | [CVE-2026-20639](https://patchblox.com/security/data/cve/CVE-2026-20639.md) | High | configd: Processing a maliciously crafted string may lead to heap corruption | 7.5 | 0.0062 | | | [CVE-2026-28876](https://patchblox.com/security/data/cve/CVE-2026-28876.md) | High | DeviceLink: An app may be able to access sensitive user data | 7.5 | 0.0049 | | | [CVE-2025-55753](https://patchblox.com/security/data/cve/CVE-2025-55753.md) | High | Apache HTTP Server: mod_md (ACME), unintended retry intervals | 7.5 | 0.0048 | | | [CVE-2026-20701](https://patchblox.com/security/data/cve/CVE-2026-20701.md) | High | NetAuth: An app may be able to connect to a network share without user consent | 7.5 | 0.0044 | | | [CVE-2026-28860](https://patchblox.com/security/data/cve/CVE-2026-28860.md) | High | Security: A local attacker may be able to modify the state of the Keychain | 7.5 | 0.0038 | | | [CVE-2026-28825](https://patchblox.com/security/data/cve/CVE-2026-28825.md) | High | SMB: An app may be able to modify protected parts of the file system | 7.1 | 0.0038 | | | [CVE-2026-20687](https://patchblox.com/security/data/cve/CVE-2026-20687.md) | High | Kernel: An app may be able to cause unexpected system termination or write kernel memory | 7.1 | 0.0035 | | | [CVE-2026-28821](https://patchblox.com/security/data/cve/CVE-2026-28821.md) | High | CoreServices: An app may be able to gain elevated privileges | 8.4 | 0.0022 | | | [CVE-2026-28832](https://patchblox.com/security/data/cve/CVE-2026-28832.md) | High | File System: An app may be able to disclose kernel memory | 8.4 | 0.0020 | | | [CVE-2026-28817](https://patchblox.com/security/data/cve/CVE-2026-28817.md) | High | Printing: A sandboxed process may be able to circumvent sandbox restrictions | 8.1 | 0.0016 | | | [CVE-2026-28891](https://patchblox.com/security/data/cve/CVE-2026-28891.md) | High | NetAuth: An app may be able to break out of its sandbox | 8.1 | 0.0015 | | | [CVE-2026-28862](https://patchblox.com/security/data/cve/CVE-2026-28862.md) | Routine | Phone: An app may be able to access user-sensitive data | 5.3 | 0.0082 | | | [CVE-2026-28880](https://patchblox.com/security/data/cve/CVE-2026-28880.md) | Routine | iCloud: An app may be able to enumerate a user's installed apps | 6.5 | 0.0079 | | | [CVE-2026-20660](https://patchblox.com/security/data/cve/CVE-2026-20660.md) | Routine | CFNetwork: A remote user may be able to write arbitrary files | 5.5 | 0.0076 | | | [CVE-2026-20690](https://patchblox.com/security/data/cve/CVE-2026-20690.md) | Routine | CoreMedia: Processing an audio stream in a maliciously crafted media file may terminate the process | 6.5 | 0.0075 | | | [CVE-2025-14524](https://patchblox.com/security/data/cve/CVE-2025-14524.md) | Routine | bearer token leak on cross-protocol redirect | 5.3 | 0.0068 | | | [CVE-2026-28886](https://patchblox.com/security/data/cve/CVE-2026-28886.md) | Routine | CoreUtils: A user in a privileged network position may be able to cause a denial-of-service | 5.9 | 0.0067 | | | [CVE-2026-20657](https://patchblox.com/security/data/cve/CVE-2026-20657.md) | Routine | Vision: Parsing a maliciously crafted file may lead to an unexpected app termination | 6.5 | 0.0056 | | | [CVE-2026-28838](https://patchblox.com/security/data/cve/CVE-2026-28838.md) | Routine | CoreServices: An app may be able to break out of its sandbox | 5.3 | 0.0049 | | | [CVE-2026-28835](https://patchblox.com/security/data/cve/CVE-2026-28835.md) | Routine | SMB: Mounting a maliciously crafted SMB network share may lead to system termination | 6.5 | 0.0047 | | | [CVE-2026-28879](https://patchblox.com/security/data/cve/CVE-2026-28879.md) | Routine | Audio: Processing maliciously crafted web content may lead to an unexpected process crash | 6.5 | 0.0046 | | | [CVE-2026-20692](https://patchblox.com/security/data/cve/CVE-2026-20692.md) | Routine | Mail: "Hide IP Address" and "Block All Remote Content" may not apply to all mail content | 5.3 | 0.0044 | | | [CVE-2026-20693](https://patchblox.com/security/data/cve/CVE-2026-20693.md) | Routine | PackageKit: An attacker with root privileges may be able to delete protected system files | 4.9 | 0.0041 | | | [CVE-2026-20697](https://patchblox.com/security/data/cve/CVE-2026-20697.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.3 | 0.0041 | | | [CVE-2026-28818](https://patchblox.com/security/data/cve/CVE-2026-28818.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.3 | 0.0041 | | | [CVE-2026-28839](https://patchblox.com/security/data/cve/CVE-2026-28839.md) | Routine | NetAuth: An app may be able to access sensitive user data | 5.3 | 0.0041 | | | [CVE-2026-28824](https://patchblox.com/security/data/cve/CVE-2026-28824.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.3 | 0.0036 | | | [CVE-2026-28828](https://patchblox.com/security/data/cve/CVE-2026-28828.md) | Routine | TCC: An app may be able to access sensitive user data | 5.3 | 0.0036 | | | [CVE-2026-20679](https://patchblox.com/security/data/cve/CVE-2026-20679.md) | Routine | CoreUI: Processing a maliciously crafted file may lead to unexpected app termination | 4.3 | 0.0036 | | | [CVE-2026-20637](https://patchblox.com/security/data/cve/CVE-2026-20637.md) | Routine | AppleKeyStore: An app may be able to cause unexpected system termination | 6.2 | 0.0035 | | | [CVE-2026-20695](https://patchblox.com/security/data/cve/CVE-2026-20695.md) | Routine | Kernel: An app may be able to determine kernel memory layout | 6.2 | 0.0033 | | | [CVE-2026-28866](https://patchblox.com/security/data/cve/CVE-2026-28866.md) | Routine | Clipboard: An app may be able to access sensitive user data | 6.2 | 0.0024 | | | [CVE-2026-28867](https://patchblox.com/security/data/cve/CVE-2026-28867.md) | Routine | Kernel: An app may be able to leak sensitive kernel state | 6.2 | 0.0023 | | | [CVE-2026-28816](https://patchblox.com/security/data/cve/CVE-2026-28816.md) | Routine | Notes: An app may be able to delete files for which it does not have permission | 4.0 | 0.0023 | | | [CVE-2026-28852](https://patchblox.com/security/data/cve/CVE-2026-28852.md) | Routine | UIFoundation: An app may be able to cause a denial-of-service | 5.5 | 0.0022 | | | [CVE-2026-20633](https://patchblox.com/security/data/cve/CVE-2026-20633.md) | Routine | Archive Utility: An app may be able to access user-sensitive data | 5.5 | 0.0022 | | | [CVE-2026-20651](https://patchblox.com/security/data/cve/CVE-2026-20651.md) | Routine | Messages: An app may be able to access sensitive user data | 6.2 | 0.0021 | | | [CVE-2026-28822](https://patchblox.com/security/data/cve/CVE-2026-28822.md) | Routine | Audio: An attacker may be able to cause unexpected app termination | 6.2 | 0.0021 | | | [CVE-2025-64505](https://patchblox.com/security/data/cve/CVE-2025-64505.md) | Routine | LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index | 6.1 | 0.0021 | | | [CVE-2026-20694](https://patchblox.com/security/data/cve/CVE-2026-20694.md) | Routine | MigrationKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2026-28868](https://patchblox.com/security/data/cve/CVE-2026-28868.md) | Routine | Kernel: An app may be able to disclose kernel memory | 5.5 | 0.0020 | | | [CVE-2026-20607](https://patchblox.com/security/data/cve/CVE-2026-20607.md) | Routine | libxpc: An app may be able to access protected user data | 4.0 | 0.0019 | | | [CVE-2026-20668](https://patchblox.com/security/data/cve/CVE-2026-20668.md) | Routine | Focus: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2026-28864](https://patchblox.com/security/data/cve/CVE-2026-28864.md) | Routine | Security: A local attacker may gain access to user's Keychain items | 3.3 | 0.0018 | | | [CVE-2026-28831](https://patchblox.com/security/data/cve/CVE-2026-28831.md) | Routine | Printing: An app may be able to access sensitive user data | 5.5 | 0.0018 | | | [CVE-2026-28892](https://patchblox.com/security/data/cve/CVE-2026-28892.md) | Routine | Diagnostics: An app may be able to modify protected parts of the file system | 5.5 | 0.0018 | | | [CVE-2026-28826](https://patchblox.com/security/data/cve/CVE-2026-28826.md) | Routine | NSColorPanel: A malicious app may be able to break out of its sandbox | 4.0 | 0.0018 | | | [CVE-2026-28829](https://patchblox.com/security/data/cve/CVE-2026-28829.md) | Routine | WebDAV: An app may be able to modify protected parts of the file system | 5.5 | 0.0017 | | | [CVE-2026-28877](https://patchblox.com/security/data/cve/CVE-2026-28877.md) | Routine | Accounts: An app may be able to access sensitive user data | 5.5 | 0.0017 | | | [CVE-2026-28888](https://patchblox.com/security/data/cve/CVE-2026-28888.md) | Routine | CUPS: An app may be able to gain root privileges | 5.1 | 0.0015 | | | [CVE-2026-28834](https://patchblox.com/security/data/cve/CVE-2026-28834.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 5.1 | 0.0015 | | | [CVE-2026-20699](https://patchblox.com/security/data/cve/CVE-2026-20699.md) | Routine | AppleMobileFileIntegrity: An app may be able to access user-sensitive data | 6.2 | 0.0014 | | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.