EUVD-2026-15157Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are unavailable for this CVE, the risk assessment relies on vulnerability characteristics and exploitation feasibility. The attack vector appears to be local (application-to-system) with low complexity, as installed applications need only invoke potentially exposed APIs without elevated privileges. The technical impact is limited to information disclosure without direct system compromise, confidentiality breach, or privilege escalation capability. The vulnerability is not listed as actively exploited in known exploit databases (KEV status unknown from provided data), and no public proof-of-concept has been documented in the references. The real-world priority is moderate: while the direct impact (application enumeration) is limited, it creates a foundation for sophisticated reconnaissance attacks, user profiling, and potential follow-on exploits targeting specific discovered applications. Organizations should prioritize patching based on user exposure to untrusted applications rather than treating this as critical. |
| Exploit ScenarioDerived | A malicious application distributed through the App Store (or sideloaded on jailbroken/developer devices) silently queries the system APIs to enumerate all installed applications during initialization or periodic background operations. The attacker collects this data to build a profile of the device's software ecosystem, identifying installed security applications, banking applications, or health monitoring tools to inform targeted phishing campaigns, credential harvesting attacks targeting specific apps, or social engineering based on known application preferences. Since the attack requires only local application execution with no elevated privileges and can operate silently in the background, affected users face exploitation risk simply by installing a compromised or malicious application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A privacy vulnerability in Apple's operating systems allows third-party applications to enumerate a user's installed applications, resulting in unauthorized information disclosure about device software inventory. The vulnerability affects iOS and iPadOS versions prior to 18.7.7 and 26.4, macOS Sonoma prior to 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4 across all affected product lines. An attacker can exploit this vulnerability by crafting a malicious application that leverages the enumeration capability to profile a user's installed software, potentially enabling further targeted attacks or privacy inference attacks based on application usage patterns.
RemediationAI
Immediately update to the patched versions: iOS and iPadOS 18.7.7 or 26.4, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4, depending on affected device. Enable automatic security updates in Settings > General > Software Update > Automatic Updates to ensure timely installation of patches. Until patching is complete, users should review installed third-party applications and uninstall untrusted or unnecessary applications that could exploit this vulnerability to profile device software inventory. Administrators in enterprise environments should enforce mandatory update policies through MDM/MAM solutions and monitor for suspicious applications requesting system information APIs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Apple's application sandboxing and inter-process communication mechanisms across multiple operating systems (iOS/iPadOS, macOS, tvOS, visionOS, watchOS as indicated by CPE strings cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos). The root cause appears to be insufficient access controls or improper filtering of sensitive system metadata that exposes installed application information to unprivileged processes. This is classified as an Information Disclosure vulnerability where the attack surface involves application-level queries to system APIs that should be restricted or require explicit user consent. The underlying weakness relates to improper restriction of sensitive resource access, where applications can query the device's package or application registry without proper authorization checks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user's installed apps.
Executive ViewAI
Organizations using A privacy should be aware of notable risk from CVE-2026-28878, a information exposure vulnerability rated CVSS 6.5. Sensitive information could be exposed to unauthorized parties. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB