# Tahoe 26.4

Tahoe 26.4, released March 24, 2026, fixes 83 CVEs in Tahoe. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/macos/tahoe-26.4
- Platform: macOS
- Released: Mar 24, 2026
- Priority: Urgent (Closes CVE-2026-28827, rated Critical)
- CVEs: 83, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://support.apple.com/en-us/126794

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Tahoe](https://patchblox.com/security/data/product/macos/tahoe.md) |  | 26.4 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-28827](https://patchblox.com/security/data/cve/CVE-2026-28827.md) | Urgent | NetFSFramework: An app may be able to break out of its sandbox | 9.3 | 0.0029 |  |
| [CVE-2026-20688](https://patchblox.com/security/data/cve/CVE-2026-20688.md) | Urgent | Printing: An app may be able to break out of its sandbox | 9.3 | 0.0029 |  |
| [CVE-2025-58098](https://patchblox.com/security/data/cve/CVE-2025-58098.md) | High | Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... | 8.3 | 0.0153 |  |
| [CVE-2025-59775](https://patchblox.com/security/data/cve/CVE-2025-59775.md) | High | Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF | 7.5 | 0.0088 |  |
| [CVE-2025-65082](https://patchblox.com/security/data/cve/CVE-2025-65082.md) | High | Apache HTTP Server: CGI environment variable override | 7.5 | 0.0087 |  |
| [CVE-2026-28865](https://patchblox.com/security/data/cve/CVE-2026-28865.md) | High | 802.1X: An attacker in a privileged network position may be able to intercept network traffic | 7.5 | 0.0079 |  |
| [CVE-2026-20664](https://patchblox.com/security/data/cve/CVE-2026-20664.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0075 |  |
| [CVE-2025-66200](https://patchblox.com/security/data/cve/CVE-2025-66200.md) | High | Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo | 7.5 | 0.0070 |  |
| [CVE-2026-28894](https://patchblox.com/security/data/cve/CVE-2026-28894.md) | High | Calling Framework: A remote attacker may be able to cause a denial-of-service | 7.5 | 0.0069 |  |
| [CVE-2026-28859](https://patchblox.com/security/data/cve/CVE-2026-28859.md) | High | WebKit: A malicious website may be able to process restricted web content outside the sandbox | 8.8 | 0.0066 |  |
| [CVE-2026-20665](https://patchblox.com/security/data/cve/CVE-2026-20665.md) | High | WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced | 8.8 | 0.0063 |  |
| [CVE-2026-28876](https://patchblox.com/security/data/cve/CVE-2026-28876.md) | High | DeviceLink: An app may be able to access sensitive user data | 7.5 | 0.0049 |  |
| [CVE-2025-55753](https://patchblox.com/security/data/cve/CVE-2025-55753.md) | High | Apache HTTP Server: mod_md (ACME), unintended retry intervals | 7.5 | 0.0048 |  |
| [CVE-2026-20701](https://patchblox.com/security/data/cve/CVE-2026-20701.md) | High | NetAuth: An app may be able to connect to a network share without user consent | 7.5 | 0.0044 |  |
| [CVE-2026-28842](https://patchblox.com/security/data/cve/CVE-2026-28842.md) | High | IOGraphics: A buffer overflow may result in memory corruption and unexpected app termination | 7.5 | 0.0040 |  |
| [CVE-2026-28860](https://patchblox.com/security/data/cve/CVE-2026-28860.md) | High | Security: A local attacker may be able to modify the state of the Keychain | 7.5 | 0.0038 |  |
| [CVE-2026-28825](https://patchblox.com/security/data/cve/CVE-2026-28825.md) | High | SMB: An app may be able to modify protected parts of the file system | 7.1 | 0.0038 |  |
| [CVE-2026-20643](https://patchblox.com/security/data/cve/CVE-2026-20643.md) | High | WebKit: Processing maliciously crafted web content may bypass Same Origin Policy | 8.8 | 0.0037 |  |
| [CVE-2026-28837](https://patchblox.com/security/data/cve/CVE-2026-28837.md) | High | System Settings: An app may be able to access sensitive user data | 7.5 | 0.0035 |  |
| [CVE-2026-20687](https://patchblox.com/security/data/cve/CVE-2026-20687.md) | High | Kernel: An app may be able to cause unexpected system termination or write kernel memory | 7.1 | 0.0035 |  |
| [CVE-2026-20631](https://patchblox.com/security/data/cve/CVE-2026-20631.md) | High | PackageKit: A user may be able to elevate privileges | 8.4 | 0.0031 |  |
| [CVE-2026-20691](https://patchblox.com/security/data/cve/CVE-2026-20691.md) | High | WebKit Sandboxing: A maliciously crafted webpage may be able to fingerprint the user | 8.8 | 0.0029 |  |
| [CVE-2026-28871](https://patchblox.com/security/data/cve/CVE-2026-28871.md) | High | WebKit: Visiting a maliciously crafted website may lead to a cross-site scripting attack | 8.8 | 0.0029 |  |
| [CVE-2026-28821](https://patchblox.com/security/data/cve/CVE-2026-28821.md) | High | CoreServices: An app may be able to gain elevated privileges | 8.4 | 0.0022 |  |
| [CVE-2026-28832](https://patchblox.com/security/data/cve/CVE-2026-28832.md) | High | File System: An app may be able to disclose kernel memory | 8.4 | 0.0020 |  |
| [CVE-2026-28896](https://patchblox.com/security/data/cve/CVE-2026-28896.md) | High | ppp: An attacker may be able to cause unexpected system termination or read kernel memory | 7.7 | 0.0019 |  |
| [CVE-2026-28817](https://patchblox.com/security/data/cve/CVE-2026-28817.md) | High | Printing: A sandboxed process may be able to circumvent sandbox restrictions | 8.1 | 0.0016 |  |
| [CVE-2026-28891](https://patchblox.com/security/data/cve/CVE-2026-28891.md) | High | NetAuth: An app may be able to break out of its sandbox | 8.1 | 0.0015 |  |
| [CVE-2026-28840](https://patchblox.com/security/data/cve/CVE-2026-28840.md) | High | PackageKit: An app may be able to gain root privileges | 7.8 | 0.0014 |  |
| [CVE-2026-28926](https://patchblox.com/security/data/cve/CVE-2026-28926.md) | High | Disk Images: An app may be able to elevate privileges | 7.0 | 0.0012 |  |
| [CVE-2026-28878](https://patchblox.com/security/data/cve/CVE-2026-28878.md) | Routine | Crash Reporter: An app may be able to enumerate a user's installed apps | 6.5 | 0.0090 |  |
| [CVE-2026-28862](https://patchblox.com/security/data/cve/CVE-2026-28862.md) | Routine | Phone: An app may be able to access user-sensitive data | 5.3 | 0.0082 |  |
| [CVE-2026-28880](https://patchblox.com/security/data/cve/CVE-2026-28880.md) | Routine | iCloud: An app may be able to enumerate a user's installed apps | 6.5 | 0.0079 |  |
| [CVE-2026-20690](https://patchblox.com/security/data/cve/CVE-2026-20690.md) | Routine | CoreMedia: Processing an audio stream in a maliciously crafted media file may terminate the process | 6.5 | 0.0075 |  |
| [CVE-2025-14524](https://patchblox.com/security/data/cve/CVE-2025-14524.md) | Routine | bearer token leak on cross-protocol redirect | 5.3 | 0.0068 |  |
| [CVE-2026-28886](https://patchblox.com/security/data/cve/CVE-2026-28886.md) | Routine | CoreUtils: A user in a privileged network position may be able to cause a denial-of-service | 5.9 | 0.0067 |  |
| [CVE-2026-20657](https://patchblox.com/security/data/cve/CVE-2026-20657.md) | Routine | Vision: Parsing a maliciously crafted file may lead to an unexpected app termination | 6.5 | 0.0056 |  |
| [CVE-2026-28838](https://patchblox.com/security/data/cve/CVE-2026-28838.md) | Routine | CoreServices: An app may be able to break out of its sandbox | 5.3 | 0.0049 |  |
| [CVE-2026-28835](https://patchblox.com/security/data/cve/CVE-2026-28835.md) | Routine | SMB: Mounting a maliciously crafted SMB network share may lead to system termination | 6.5 | 0.0047 |  |
| [CVE-2026-28879](https://patchblox.com/security/data/cve/CVE-2026-28879.md) | Routine | Audio: Processing maliciously crafted web content may lead to an unexpected process crash | 6.5 | 0.0046 |  |
| [CVE-2026-20692](https://patchblox.com/security/data/cve/CVE-2026-20692.md) | Routine | Mail: "Hide IP Address" and "Block All Remote Content" may not apply to all mail content | 5.3 | 0.0044 |  |
| [CVE-2026-20693](https://patchblox.com/security/data/cve/CVE-2026-20693.md) | Routine | PackageKit: An attacker with root privileges may be able to delete protected system files | 4.9 | 0.0041 |  |
| [CVE-2026-20697](https://patchblox.com/security/data/cve/CVE-2026-20697.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.3 | 0.0041 |  |
| [CVE-2026-28818](https://patchblox.com/security/data/cve/CVE-2026-28818.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.3 | 0.0041 |  |
| [CVE-2026-28839](https://patchblox.com/security/data/cve/CVE-2026-28839.md) | Routine | NetAuth: An app may be able to access sensitive user data | 5.3 | 0.0041 |  |
| [CVE-2026-28824](https://patchblox.com/security/data/cve/CVE-2026-28824.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.3 | 0.0036 |  |
| [CVE-2026-28828](https://patchblox.com/security/data/cve/CVE-2026-28828.md) | Routine | TCC: An app may be able to access sensitive user data | 5.3 | 0.0036 |  |
| [CVE-2026-20679](https://patchblox.com/security/data/cve/CVE-2026-20679.md) | Routine | CoreUI: Processing a maliciously crafted file may lead to unexpected app termination | 4.3 | 0.0036 |  |
| [CVE-2026-28844](https://patchblox.com/security/data/cve/CVE-2026-28844.md) | Routine | SystemMigration: An attacker may gain access to protected parts of the file system | 6.5 | 0.0035 |  |
| [CVE-2026-20698](https://patchblox.com/security/data/cve/CVE-2026-20698.md) | Routine | Kernel: An app may be able to cause unexpected system termination or corrupt kernel memory | 5.5 | 0.0034 |  |
| [CVE-2026-20695](https://patchblox.com/security/data/cve/CVE-2026-20695.md) | Routine | Kernel: An app may be able to determine kernel memory layout | 6.2 | 0.0033 |  |
| [CVE-2026-28861](https://patchblox.com/security/data/cve/CVE-2026-28861.md) | Routine | WebKit: A malicious website may be able to access script message handlers intended for other origins | 4.3 | 0.0032 |  |
| [CVE-2026-20632](https://patchblox.com/security/data/cve/CVE-2026-20632.md) | Routine | Music: An app may be able to access sensitive user data | 5.3 | 0.0031 |  |
| [CVE-2026-28823](https://patchblox.com/security/data/cve/CVE-2026-28823.md) | Routine | Admin Framework: An app with root privileges may be able to delete protected system files | 4.9 | 0.0031 |  |
| [CVE-2026-28866](https://patchblox.com/security/data/cve/CVE-2026-28866.md) | Routine | Clipboard: An app may be able to access sensitive user data | 6.2 | 0.0024 |  |
| [CVE-2026-28867](https://patchblox.com/security/data/cve/CVE-2026-28867.md) | Routine | Kernel: An app may be able to leak sensitive kernel state | 6.2 | 0.0023 |  |
| [CVE-2026-28816](https://patchblox.com/security/data/cve/CVE-2026-28816.md) | Routine | Notes: An app may be able to delete files for which it does not have permission | 4.0 | 0.0023 |  |
| [CVE-2026-28852](https://patchblox.com/security/data/cve/CVE-2026-28852.md) | Routine | UIFoundation: An app may be able to cause a denial-of-service | 5.5 | 0.0022 |  |
| [CVE-2026-20633](https://patchblox.com/security/data/cve/CVE-2026-20633.md) | Routine | Archive Utility: An app may be able to access user-sensitive data | 5.5 | 0.0022 |  |
| [CVE-2026-28820](https://patchblox.com/security/data/cve/CVE-2026-28820.md) | Routine | StorageKit: An app may be able to access sensitive user data | 5.5 | 0.0022 |  |
| [CVE-2026-28822](https://patchblox.com/security/data/cve/CVE-2026-28822.md) | Routine | Audio: An attacker may be able to cause unexpected app termination | 6.2 | 0.0021 |  |
| [CVE-2025-64505](https://patchblox.com/security/data/cve/CVE-2025-64505.md) | Routine | LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index | 6.1 | 0.0021 |  |
| [CVE-2026-20694](https://patchblox.com/security/data/cve/CVE-2026-20694.md) | Routine | MigrationKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 |  |
| [CVE-2026-28882](https://patchblox.com/security/data/cve/CVE-2026-28882.md) | Routine | libxpc: An app may be able to enumerate a user's installed apps | 4.0 | 0.0020 |  |
| [CVE-2026-28868](https://patchblox.com/security/data/cve/CVE-2026-28868.md) | Routine | Kernel: An app may be able to disclose kernel memory | 5.5 | 0.0020 |  |
| [CVE-2026-20607](https://patchblox.com/security/data/cve/CVE-2026-20607.md) | Routine | libxpc: An app may be able to access protected user data | 4.0 | 0.0019 |  |
| [CVE-2026-28864](https://patchblox.com/security/data/cve/CVE-2026-28864.md) | Routine | Security: A local attacker may gain access to user's Keychain items | 3.3 | 0.0018 |  |
| [CVE-2026-28831](https://patchblox.com/security/data/cve/CVE-2026-28831.md) | Routine | Printing: An app may be able to access sensitive user data | 5.5 | 0.0018 |  |
| [CVE-2026-28881](https://patchblox.com/security/data/cve/CVE-2026-28881.md) | Routine | iCloud: An app may be able to access sensitive user data | 5.3 | 0.0018 |  |
| [CVE-2026-28892](https://patchblox.com/security/data/cve/CVE-2026-28892.md) | Routine | Diagnostics: An app may be able to modify protected parts of the file system | 5.5 | 0.0018 |  |
| [CVE-2026-28826](https://patchblox.com/security/data/cve/CVE-2026-28826.md) | Routine | NSColorPanel: A malicious app may be able to break out of its sandbox | 4.0 | 0.0018 |  |
| [CVE-2026-28829](https://patchblox.com/security/data/cve/CVE-2026-28829.md) | Routine | WebDAV: An app may be able to modify protected parts of the file system | 5.5 | 0.0017 |  |
| [CVE-2026-28877](https://patchblox.com/security/data/cve/CVE-2026-28877.md) | Routine | Accounts: An app may be able to access sensitive user data | 5.5 | 0.0017 |  |
| [CVE-2026-28841](https://patchblox.com/security/data/cve/CVE-2026-28841.md) | Routine | IOGraphics: A buffer overflow may result in memory corruption and unexpected app termination | 6.2 | 0.0017 |  |
| [CVE-2026-28870](https://patchblox.com/security/data/cve/CVE-2026-28870.md) | Routine | GeoServices: An app may be able to access sensitive user data | 5.5 | 0.0017 |  |
| [CVE-2026-28888](https://patchblox.com/security/data/cve/CVE-2026-28888.md) | Routine | CUPS: An app may be able to gain root privileges | 5.1 | 0.0015 |  |
| [CVE-2026-28834](https://patchblox.com/security/data/cve/CVE-2026-28834.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 5.1 | 0.0015 |  |
| [CVE-2026-20699](https://patchblox.com/security/data/cve/CVE-2026-20699.md) | Routine | AppleMobileFileIntegrity: An app may be able to access user-sensitive data | 6.2 | 0.0014 |  |
| [CVE-2026-20684](https://patchblox.com/security/data/cve/CVE-2026-20684.md) | Routine | AppleScript: An app may bypass Gatekeeper checks | 3.3 | 0.0014 |  |
| [CVE-2026-28845](https://patchblox.com/security/data/cve/CVE-2026-28845.md) | Routine | LaunchServices: An app may be able to access protected user data | 5.5 | 0.0013 |  |
| [CVE-2026-28893](https://patchblox.com/security/data/cve/CVE-2026-28893.md) | Routine | CUPS: A document may be written to a temporary file when using print preview | 3.3 | 0.0012 |  |
| [CVE-2026-28910](https://patchblox.com/security/data/cve/CVE-2026-28910.md) | Routine | Archive Utility: A malicious app may be able to access arbitrary files | 3.3 | 0.0012 |  |
| [CVE-2026-28830](https://patchblox.com/security/data/cve/CVE-2026-28830.md) | Routine | Security: An app may be able to access sensitive user data | 4.7 | 0.0009 |  |

---

Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.