What is the CVSS score of CVE-2026-64743?

CVE-2026-64743 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64743?

Yes, a patch is available for CVE-2026-64743. Update the affected software to the latest version immediately.

Apple iOS CVE-2026-64743

EUVD-2026-49624 MEDIUM

Improper Authorization (CWE-285)

2026-07-27 apple

GHSA-fmvh-w4vp-v9x9

Authentication Bypass Apple Tvos Visionos Watchos Ios And Ipados

6.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

User interaction required, no privileges needed, only confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 17:26 vuln.today

CVSS changed

Jul 28, 2026 - 17:22 NVD

6.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

MEDIUM 6.5

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.

AnalysisAI

An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.

Technical ContextAI

The vulnerability is an improper authorization (CWE-285) in Apple's operating system permission management. The affected products include multiple Apple OS families as identified by CPE: iOS and iPadOS, macOS, tvOS, visionOS, and watchOS. The root cause is an authorization issue that was addressed with improved state management, meaning the system failed to correctly enforce access controls when an app requested sensitive data, allowing unauthorized access.

RemediationAI

The primary fix is to update affected devices to the patched versions: iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No workarounds are documented; users should install available updates via Software Update. Advisory URLs are provided in the affected products section.