What is the CVSS score of CVE-2026-43759?

CVE-2026-43759 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43759?

Yes, a patch is available for CVE-2026-43759. Update the affected software to the latest version immediately.

macOS CVE-2026-43759

EUVD-2026-49466 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-355h-q98w-p9m8

Apple Information Disclosure Watchos

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Requires local access and user interaction, no privileges needed, confidentiality impact high.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:30 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.6, watchOS 26.6. An app may be able to access sensitive user data.

AnalysisAI

Local information disclosure in macOS Tahoe and watchOS allows an installed app to access sensitive user data without proper authorization. The vulnerability requires user interaction and is fixed in macOS Tahoe 26.6 and watchOS 26.6. No active exploitation or public exploit has been reported, and EPSS probability is low at 0.15%.

Technical ContextAI

The vulnerability stems from an authorization issue in the operating system's state management, classified as CWE-200 (Information Exposure). The affected products are Apple macOS Tahoe and watchOS, as identified by CPE identifiers cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* and cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*. The root cause is improper handling of permission states, allowing a locally installed app to bypass checks and read sensitive user data such as contacts or files.

RemediationAI

Update to macOS Tahoe 26.6 or watchOS 26.6 through System Settings or Apple Software Update. No workarounds are available; applying the vendor patch is the only mitigation. Advisory URLs: https://support.apple.com/en-us/128067 and https://support.apple.com/en-us/128068.