EUVD-2026-77961
GHSA-x35f-96ph-cjhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryApp runs under local user context
-
ExploitAbuse permissions gap to query account identifier
-
ExecutionRead persistent account ID
-
ImpactExfiltrate for cross-app tracking
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a locally installed and running application on the affected Apple device (AV:L) - a remote, unauthenticated network attack is not possible. The malicious app leverages the permissions flaw to read a persistent account identifier it should not have access to. Limiting factors: the attacker must first get their app installed and run by the user (UI:R), the impact is confined to reading one persistent identifier (no write/integrity or availability effect), and the fix simply adds additional access restrictions. Affects default configurations of iOS/iPadOS, macOS, tvOS, visionOS, and watchOS prior to the fixed versions. |
| Impact | This is a low-to-moderate real-world risk, not an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 5.5 Medium) confirms LOCAL attack vector - the malicious code must already be running on the device as an installed app - and confidentiality-only impact with no integrity or availability effect. EPSS is low at 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit has been identified, so all exploitation signals point to low likelihood of opportunistic mass exploitation. No SSVC data is provided. One notable calibration concern: Apple rated confidentiality as C:H, but the described impact is reading a single 'persistent account identifier' (a privacy/cross-app-tracking concern, CWE-200), which most analysts would score as C:L rather than the full-data-disclosure implied by C:H - this appears over-scored for the actual leak. Net assessment: a genuine but narrow local privacy/tracking flaw, patched across Apple's product line, warranting routine patch-cycle remediation rather than emergency action. |
| Exploit ScenarioDerived | A user installs a seemingly benign third-party app from the App Store or via sideloading; the app abuses the permissions weakness to read a persistent account identifier that should be off-limits to it. That identifier is then used to fingerprint and track the user persistently across apps or exfiltrated to a remote server. No public exploit code is known, and exploitation requires the attacker to get their app onto the target device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Information disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS allows a locally installed and running app to read a persistent account identifier that the operating system should have kept out of its reach. The root cause is a permissions/sandbox restriction gap (CWE-200), fixed by Apple with additional access restrictions in iOS and iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27; successful exploitation requires the user to install and launch a malicious local app (AV:L/PR:N/UI:R), so a remote, unauthenticated network attack is not possible. There is no public exploit identified at time of analysis and EPSS is 0.18% (8th percentile), making this low-to-moderate risk rather than an urgent priority, with impact confined to the confidentiality of one identifier and no integrity or availability effect.
RemediationAI
Vendor-released patch: apply iOS 26.7 or iOS 27 and iPadOS 26.7 or iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27, as documented in Apple's advisories (https://support.apple.com/en-us/149034, 149035, 149036, 149037, 149038, 149041, 149042 and 149043); patch data states a vendor fix is available, and these are the exact fixed versions, so upgrade rather than relying on mitigations. No practical network or configuration workaround removes the exposure, because the attacker must already have a locally installed, user-launched app (AV:L/UI:R) - the meaningful compensating controls are therefore application-installation controls rather than network filtering: on managed fleets, use MDM to restrict app installation to the managed App Store or allow-listed apps and disable sideloading/untrusted developer profiles, accepting the trade-off that this reduces user flexibility and can block legitimate line-of-business apps; enable and monitor app-installation and entitlement telemetry to detect unexpected third-party apps that query identity data; and treat the disclosed identifier as compromised for affected accounts where correlation risk matters, noting that Apple provides no documented user-facing way to rotate this persistent identifier, so full remediation of the leak depends on the OS update. Given no public exploit identified at time of analysis and a low EPSS of 0.18%, this can be scheduled with normal patch cycles rather than treated as an emergency, but the fix should not be deferred indefinitely on devices that permit arbitrary third-party app installation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a permissions problem in Apple's cross-platform operating system family, tracked as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and classified by CPE data against apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos and apple:watchos. Apple's platforms enforce access to sensitive identity data through per-process entitlements, sandbox profiles and privacy (TCC-style) permission gates; a persistent account identifier is normally a stable, per-account token intended for system and first-party use, precisely because it is long-lived and thus usable to correlate activity across sessions and apps. Here the restriction logic was insufficient, so a sandboxed third-party app could obtain that identifier despite lacking authorisation. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N describes a local attack with no privileges required but requiring user interaction, scope unchanged and no integrity or availability impact; our independent assessment keeps the same vector shape but scores confidentiality as low (C:L), reflecting that a single identifier is disclosed rather than bulk sensitive data, and the fix is simply the addition of further access restrictions rather than a memory-safety or logic overhaul. Because the same code path exists across six OS products, Apple shipped a coordinated multi-advisory fix set (support.apple.com/en-us/149034 through 149043), corresponding to ENISA EUVD-2026-77961, rather than a single OS patch.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local malicious app (AV:L) run by the user (UI:R) with no prior privileges (PR:N); leak of a single persistent identifier is confidentiality-low (C:L), not C:H, with no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB