What is the CVSS score of CVE-2026-64746?

CVE-2026-64746 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple iOS are affected by CVE-2026-64746?

Apple's Contacts framework (iOS, iPadOS, macOS Tahoe, visionOS, watchOS versions before 26.6) contains a missing authorization flaw that allows installed applications to add contact entries without…. A patch is available.

How to fix or mitigate CVE-2026-64746?

Within 24 hours, inventory Apple device deployments across iOS, iPadOS, macOS Tahoe, visionOS, and watchOS platforms to identify exposure scope. Within 7 days, begin staged deployment of vendor-released patch versions 26.6 and later across the installed base, prioritizing devices used by sensitive data handlers and executives. Within 30 days, complete full rollout to all endpoints and confirm patch compliance via mobile device management (MDM) or equivalent tooling.

Apple iOS CVE-2026-64746

EUVD-2026-49430 CRITICAL

Missing Authorization (CWE-862)

2026-07-27 apple

GHSA-4977-wv8w-jw7p

Apple Authentication Bypass Ios And Ipados Visionos Watchos

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.0 MEDIUM

A locally-running app reaches the flaw (AV:L), needs no privileges or prompt (PR:N/UI:N), and only writes contacts - low integrity impact, no confidentiality or availability loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:28 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

CRITICAL 9.8

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add contacts without user authorization.

AnalysisAI

Missing authorization in Apple's Contacts framework across iOS/iPadOS, macOS Tahoe, visionOS, and watchOS (all versions before 26.6) allows an installed app to add contact entries without triggering the user's authorization prompt. Apple fixed the flaw with improved validation in the 26.6 releases. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.16% (6th percentile), consistent with a low-severity local privacy-scope bypass despite the input's inflated 9.8 score.

Technical ContextAI

The vulnerability is a CWE-862 Missing Authorization weakness in Apple's Contacts subsystem, which is normally gated by the TCC (Transparency, Consent, and Control) privacy framework that forces apps to obtain explicit user consent before reading or writing address-book data. Per Apple, an authorization check was insufficiently validated, so the write path (adding contacts) could be reached without the consent gate being enforced. The affected CPEs are cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos, indicating the shared Contacts code is common across Apple's OS family rather than a single-platform bug.

RemediationAI

Vendor-released patch: update to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6, which address the issue with improved validation; details are in Apple's advisories at https://support.apple.com/en-us/128066, 128067, 128068, and 128070. Because exploitation requires code running on the device, the most effective compensating control until patching is to restrict app installation to vetted App Store or MDM-approved sources and to audit apps requesting or manipulating Contacts data - trade-off: this tightens app provisioning but does not remove the underlying bug. On managed fleets, enforcing the 26.6 minimum-OS baseline via MDM is the cleanest interim gate; there is no need to disable Contacts sync, which would break legitimate functionality for marginal benefit.