EUVD-2026-77854
GHSA-g3xq-9vpj-m4xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run malicious app on device
-
ExploitInvoke API with improper authorization check
-
ExecutionBypass on-device network restriction
-
ImpactExfiltrate or reach restricted network endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker-controlled app already installed and executing on the affected Apple device (iOS/iPadOS, macOS, visionOS, or watchOS before version 27); there is no remote or unauthenticated vector. The app leverages a missing-authorization logic flaw (CWE-862) to bypass the OS's network-restriction enforcement. Limiting factors: local access is mandatory (AV:L), the app runs only with normal sandboxed app privileges (PR:L), impact is confined to low confidentiality/integrity with no availability effect, and the device must be running an unpatched pre-27 OS build. |
| Impact | This is a genuine but low-severity issue. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 4.4 Medium) makes clear this is NOT remotely exploitable: it requires code already running locally on the device - i.e. a malicious or compromised app that has already passed App Store review or sideloading. The impact is bounded (C:L/I:L, A:N) because it only lets an app circumvent network restrictions, not achieve full data compromise or code execution. EPSS is 0.21% (11th percentile), consistent with a local logic bug that is not mass-exploitable. It is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation. The 'Authentication Bypass' tag overstates the issue; CWE-862 (Missing Authorization) plus the 'bypass network restrictions' description point to an authorization/policy-enforcement gap, not credential bypass. Net: a real, patch-worthy defense-in-depth fix, but low real-world priority relative to network-reachable Apple bugs. No key signals conflict - the local vector in CVSS aligns with the 'An app may be able to...' phrasing in the description. |
| Exploit ScenarioDerived | A malicious app installed on an iPhone, Mac, or other Apple device abuses a logic flaw in network-policy enforcement to send traffic that should have been blocked by on-device network restrictions (e.g. content filters, VPN scoping, or per-app network rules). No public exploit code is referenced, and exploitation requires the attacker's code to already be executing locally with normal app privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Bypass of on-device network restrictions in Apple iOS/iPadOS, macOS Golden Gate, visionOS, and watchOS builds prior to version 27 allows a locally installed, already-running app to reach network resources the operating system should have blocked, producing low confidentiality and low integrity impact with no availability effect. Exploitation requires an app that is already installed and executing with normal, authenticated app privileges on the target device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.4); there is no remote or unauthenticated attack path, no public exploit identified at time of analysis, and EPSS is a low 0.21% (11th percentile). Apple has shipped vendor-released fixes in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
RemediationAI
Vendor-released patch: iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 - apply these updates per Apple's advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149037, and https://support.apple.com/en-us/149038, prioritizing mobile devices with side-loaded or unmanaged apps since the attack requires an already-installed app. Until devices can be updated, reduce the attack surface by enforcing MDM app allowlisting and blocking installation of untrusted or side-loaded apps, removing unvetted apps from managed devices, and using network-level controls such as VPN or DNS/content filtering to limit what a bypassing app can actually reach; note the trade-offs - MDM allowlisting adds administrative overhead and can break legitimate workflows, network-layer filtering cannot distinguish a bypassing app from legitimate traffic and may miss local-network or peer-to-peer egress, and disabling network features for the device is impractical, so these are interim measures rather than substitutes for the version 27 updates. No workaround fully restores the intended enforcement, and because the issue has low EPSS (0.21%) with no public exploit identified at time of analysis, patch deployment can follow normal Apple update cycles rather than emergency change control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in a logic error classified as CWE-862 (Missing Authorization): the code path responsible for enforcing Apple's network-restriction policy made an authorization decision using flawed validation, letting an app that should have been denied reach network resources; Apple resolved it in the version 27 releases by adding improved validation. This is an access-control/authorization weakness rather than memory corruption or injection, so it does not grant code execution and is bounded by the standard app sandbox profile. The impact is shared across Apple's platform networking/restriction-enforcement layer, which is why the CPE data lists cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*, and cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:* with wildcard versions that, per EUVD-2026-77854, represent all builds below 27 (visionOS 0 <27, macOS 0 <27, watchOS 0 <27, iOS and iPadOS 0 <27). Because the defect is a missing authorization check exploited from an already-installed app running at normal sandboxed privileges (AV:L/PR:L), the assessed consequence is confined to low confidentiality and low integrity with no availability impact, matching the 4.4 score.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitation needs a locally installed app with normal privileges (AV:L/PR:L), no user interaction, and only partially bypasses network policy (C:L/I:L, A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB