EUVD-2026-77960
GHSA-63gj-w77j-2xjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser installs malicious app
-
DeliveryApp invokes affected API locally
-
ExploitBypass access-control check (CWE-863)
-
ExecutionRead persistent device identifiers
-
ImpactExfiltrate for cross-app tracking
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised application already installed and executing on the affected Apple device (AV:L, UI:R) - the user must install/run the app. There is no remote or network exploitation path. Exploitation is limited to devices running affected OS versions prior to the fixes (iOS/iPadOS before 26.7/27, macOS before Sequoia 15.8 / Tahoe 26.7 / Golden Gate 27, tvOS/visionOS/watchOS before 27). No special device configuration is needed beyond running an unpatched OS; the flaw lets an ordinary app (PR:N) obtain persistent device identifiers it should not have access to. The limiting factors are the local-only vector, the need for user interaction to install the app, and the confidentiality-only, privacy-scoped impact. |
| Impact | This is a genuinely low-to-moderate real-world risk. The vendor CVSS of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) correctly characterizes it as a LOCAL vulnerability: an attacker needs a malicious app already running on the device, not network access. All signals agree it is not a priority for emergency patching: EPSS is very low at 0.17% (7th percentile), it is NOT in CISA KEV, and no public POC has been identified. Exploitation status is 'no public exploit identified at time of analysis.' The impact is confidentiality-only (C:H, I:N, A:N) - reading persistent device identifiers, which is a privacy/tracking concern rather than device compromise. The C:H rating is arguably generous for what amounts to identifier disclosure rather than bulk sensitive-data theft; a case could be made for C:L, which would lower the score. No signals conflict: low EPSS, no KEV, and local-only vector all point to a low-urgency privacy fix rather than a critical flaw. The main reason to patch promptly is the enormous install base, not exploit likelihood. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from the App Store (or sideloaded); the app abuses the access-control flaw to read persistent, non-resettable device identifiers that Apple normally shields from apps. The attacker uses these identifiers to build a stable cross-app/cross-session tracking profile of the user, defeating Apple's anti-fingerprinting protections. No public exploit code exists, and exploitation requires the user to run the malicious app (UI:R, local vector). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Persistent device identifier disclosure in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS stems from an incorrect authorization check that lets an ordinary, unprivileged installed app read identifiers it should not be able to access (CWE-863, CVSS 5.5, C:H/I:N/A:N). Exploitation is local-only (AV:L, PR:N) and requires user interaction to install and launch a malicious or compromised application on a device running an unpatched OS; there is no remote or network path, and no public exploit code has been identified at time of analysis, with EPSS at 0.17% (7th percentile) and no CISA KEV listing. Apple has released fixed versions and the impact is confined to confidentiality/privacy rather than code execution or data modification.
RemediationAI
Vendor-released patches are available: update iOS and iPadOS to 26.7 or 27, macOS Sequoia to 15.8, macOS Tahoe to 26.7, macOS Golden Gate to 27, and tvOS, visionOS and watchOS to 27; consult the corresponding Apple advisories (support.apple.com/en-us/149034 through 149043) for the platform-specific build. Because the defect is an incorrect authorization check in system code rather than a configurable feature, there is no meaningful in-place workaround that preserves full functionality - the only complete fix is the OS update, and third-party apps cannot remediate it themselves. If immediate patching is not possible, compensating controls are limited to reducing the attack precondition of installing a hostile app: enforce MDM app allowlisting or managed app installation on supervised iOS/iPadOS, macOS, tvOS, visionOS and watchOS devices (trade-off: blocks legitimate sideloaded/enterprise apps and requires device supervision), restrict managed devices to curated App Store or enterprise catalogs, and restrict app installation to administrator accounts on macOS (trade-off: affects legitimate developer and power-user workflows). These controls reduce likelihood but do not close the identifier leak, since the flaw is reachable by any app already installed before the policy was applied, so treat OS updates as the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization): a system component or framework that brokers access to persistent device identifiers failed to enforce the correct entitlement or sandbox check, so an application that should have been denied was instead granted read access. Apple platform security normally gates such identifiers behind app entitlements and per-app user consent; the flaw is that this authorization gate was missing or evaluated incorrectly, not that memory was corrupted or a cryptographic primitive broken. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms the class: the attack executes locally with low complexity, requires no granted privileges (PR:N - any unprivileged app qualifies), needs the user to install/run the app (UI:R), stays within a single security scope, and yields high confidentiality impact with no integrity or availability effect. CPE data (cpe:2.3:a:apple:ios_and_ipados, macos, tvos, visionos, watchos) shows the same authorization defect was inherited across Apple's shared OS codebase, which is why a single advisory wave covers iOS/iPadOS, macOS, tvOS, visionOS and watchOS. The identifiers at risk are persistent, meaning leakage could enable cross-application tracking or correlation of a user's activity beyond what Apple's privacy model permits.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local malicious app (AV:L) with no privileges (PR:N) but requiring user install (UI:R) reads identifiers; confidentiality-only impact, no integrity or availability effect.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB