What is the CVSS score of CVE-2026-43758?

CVE-2026-43758 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43758?

Yes, a patch is available for CVE-2026-43758. Update the affected software to the latest version immediately.

macOS CVE-2026-43758

EUVD-2026-49626 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-2h5h-2fc6-g2qv

Apple Information Disclosure Watchos

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack via a crafted app with user interaction; no privileges required, confidentiality impact only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 19:27 vuln.today

CVSS changed

Jul 28, 2026 - 19:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. An app may be able to access sensitive user data.

AnalysisAI

Sensitive user data can be accessed by unauthorized apps on macOS and watchOS due to an authorization flaw in state management. Apple released patches in macOS Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6, and watchOS 26.6. No public exploit or active exploitation is known; EPSS indicates a low likelihood of exploitation.

Technical ContextAI

This vulnerability stems from an authorization weakness (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in how macOS and watchOS manage state during app operations. The affected products, identified by CPE cpe:2.3:a:apple:macos and cpe:2.3:a:apple:watchos, improperly handle access controls, allowing a local application to read sensitive user data that should be protected. The issue is resolved through improved state management in the operating system.

RemediationAI

Update to the patched versions: macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, or watchOS 26.6. No workarounds are available; only applying the vendor fix eliminates the flaw.