What is the CVSS score of CVE-2026-64710?

CVE-2026-64710 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64710?

Yes, a patch is available for CVE-2026-64710. Update the affected software to the latest version immediately.

macOS CVE-2026-64710

EUVD-2026-49538 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-7954-q27w-w8x8

Information Disclosure Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack with required user interaction; no privileges needed; high confidentiality impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:39 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:13 cve.org

MEDIUM 5.5

DescriptionCVE.org

A privacy issue was addressed by removing sensitive data. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to leak sensitive user information.

AnalysisAI

Information disclosure in macOS prior to 15.7.8, 14.8.8, and 26.6 allows a malicious app to leak sensitive user information. The vulnerability arises from improper removal of sensitive data, which Apple addressed in these updates. No active exploitation is known, and EPSS indicates a low probability of exploitation (0.16%).

Technical ContextAI

The vulnerability resides in Apple's macOS handling of sensitive operating system data exposed to applications. Classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), it stems from a failure to properly sanitise or remove confidential information, allowing local apps to access it. The impacted product, as per CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, spans all macOS versions prior to the listed fixes. Apple's mitigation involved removing the sensitive data entirely rather than tightening access controls.

RemediationAI

Upgrade to macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6, which remove the exposed sensitive data. No viable workaround exists; the only complete remediation is to apply the vendor patch. Advisories: https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, https://support.apple.com/en-us/128072.