What is the CVSS score of CVE-2026-43801?

CVE-2026-43801 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43801?

Yes, a patch is available for CVE-2026-43801. Update the affected software to the latest version immediately.

Apple iOS CVE-2026-43801

EUVD-2026-49519 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-rg7x-6v9m-w6q2

Information Disclosure Apple Tvos Visionos Watchos Ios And Ipados

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local malicious app (AV:L) with user interaction to install/run (UI:R); confidentiality-only data access (C:H, I:N, A:N), matching CWE-200; vendor vector is well-calibrated.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:31 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:13 cve.org

MEDIUM 5.5

DescriptionCVE.org

This issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.

AnalysisAI

Local information disclosure in Apple iOS/iPadOS 26.x, macOS Tahoe 26.x, macOS Sequoia 15.x, macOS Sonoma 14.x, tvOS 26.x, visionOS 26.x and watchOS 26.x lets an app installed and run by the user read sensitive user data because of insufficient access checks (CWE-200), a flaw Apple fixed in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6 and watchOS 26.6. Exploitation requires the user to install and launch a malicious or malicious-behaving app on an unpatched device (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5); there is no remote or network-reachable path and no privilege escalation is needed, so the practical exposure is limited to confidentiality on devices where sideloaded or otherwise untrusted apps are allowed. There is no public exploit identified at time of analysis, CISA's SSVC decision framework records exploitation as none and technical impact as partial, and EPSS is only 0.17% (6th percentile), so every signal aligns with a genuine but low-priority issue that should be resolved by routine patch cycles rather than emergency response.

Technical ContextAI

The flaw is a CWE-200 exposure-of-sensitive-information issue caused by what Apple describes only as insufficient checks, addressed by improved validation in the affected system component; Apple credits no external reporter, which is consistent with an internally discovered logic or state-validation gap in a shared framework or service that an app can reach from within its own sandbox. The authoritative CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N precisely frames the boundary conditions: the attack surface is local only (AV:L) with no network-reachable vector, no privileges are required (PR:N) so any sandboxed app is a candidate trigger, user interaction (UI:R) is needed in the form of installing and launching that app, and the sole impacted property is confidentiality (C:H) with no integrity or availability impact. CPE data enumerates Apple iOS and iPadOS, macOS, tvOS, visionOS and watchOS as affected platforms, and EUVD version ranges narrow this to builds below iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6 and watchOS 26.6, indicating a shared cross-platform component rather than an app-specific bug. The reporting source is Apple itself and the technical impact in CISA's SSVC assessment is partial, with automatable exploitation marked no, which is consistent with the need to deliver and run an application locally rather than exploiting a wormable or scan-and-pwn service.

RemediationAI

Vendor-released patches are available: upgrade to iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, visionOS 26.6 and watchOS 26.6, as documented in the Apple advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128072 and https://support.apple.com/en-us/148287. Because the attack requires a locally installed app that the user launches, the most effective compensating control for fleets that cannot patch immediately is to restrict app installation on managed devices - enforce App Store-only or allow-listed application deployment through MDM profiles, disable sideloading/developer-mode trust prompts, and on macOS keep Gatekeeper and notarization enforcement enabled and remove any locally approved untrusted developers; the trade-off is reduced flexibility for line-of-business or test builds, and these measures reduce but do not eliminate the risk because a malicious app obtained through legitimate channels could still exercise the flawed access check. Blocking network access or adding endpoint firewalls does not help here since the vector (AV:L) has no network component, and no privilege-escalation-specific hardening is warranted given PR:N with confidentiality-only impact. Prioritize updating macOS Sequoia and Sonoma machines and any iOS/iPadOS devices that permit enterprise sideloading; the EPSS score of 0.17% and SSVC exploitation value of none support scheduling these updates in normal maintenance windows rather than invoking emergency change procedures.