EUVD-2026-78033
GHSA-pxw2-qw67-hqr2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitInvoke flawed authorization path
-
ExecutionRead protected device identifier
-
ImpactFingerprint and track device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a locally installed app running on iOS or iPadOS before 26.7 (or before 27) that abuses the authorization/state-management flaw to obtain a device-fingerprinting identifier. Limiting factors: the attacker must first get an app onto the victim device (via App Store or sideloading), the impact is confined to reading a device identifier (no code execution, no data modification, no availability loss), and there is no remote or network-based vector despite the vendor's AV:N rating. Patched by updating to iOS/iPadOS 26.7 or 27. |
| Impact | This is a low real-world risk despite the vendor's CVSS 7.5. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) directly contradicts the description in two ways: the description states 'An app may be able to fingerprint the device,' which implies a LOCAL, already-installed app (AV:L, PR:L) rather than a remote unauthenticated attacker (AV:N/PR:N), and the impact is device fingerprinting - a confidentiality/privacy leak, not the high integrity impact (I:H) the vendor encoded. The I:H metric appears to be an error; a fingerprinting identifier leak is a small confidentiality disclosure (C:L), consistent with Apple's other fingerprinting CVEs in this same advisory wave. EPSS is 0.15% (5th percentile), there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' Signals align on low priority: low EPSS, no active exploitation, and a limited privacy-only impact gated behind local app installation. Treat the 7.5 as inflated - verify the corrected vector with the vendor advisory (support.apple.com/149034, 149041). This is a high-CVSS-but-low-real-risk issue. |
| Exploit ScenarioDerived | A malicious or overreaching app installed on an iPhone or iPad abuses an authorization/state-management flaw to read a stable device-identifying attribute it should not have access to, allowing it to fingerprint the device and persistently track the user across sessions or app reinstalls. No public exploit code exists, and the attacker must first get their app onto the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Device fingerprinting on Apple iOS and iPadOS before 26.7 (and before 27) lets a locally installed app defeat an authorization/state-management check and read a device-stable identifier it should not be able to obtain, weakening user privacy and enabling cross-app tracking or device re-identification. Exploitation requires an attacker to first get a malicious or privacy-invasive app onto the device (App Store distribution or sideloading), and the assessed impact is confidentiality-only - reading an identifier, with no code execution, data modification, or availability loss - so the vendor's CVSS 7.5 (AV:N/PR:N/I:H) overstates the practical risk relative to the assessed local, low-impact vector; this is a low real-world risk, confirmed patched by iOS/iPadOS 26.7 or 27, with no public exploit identified at time of analysis and a low EPSS score of 0.15% (5th percentile).
RemediationAI
Vendor-released patch: iOS 26.7 and iPadOS 26.7, and iOS 27 and iPadOS 27 - install the update through Settings > General > Software Update or via MDM-deployed OS updates, referencing Apple advisories https://support.apple.com/en-us/149034 and https://support.apple.com/en-us/149041. Where updating immediately is not possible, the practical compensating controls are app-installation restrictions rather than network controls, since the assessed attack path is a locally installed app rather than a remote vector: enforce MDM/Apple Configurator policy to block App Store installs and (critically) prevent sideloading/provisioned enterprise app installation, restrict third-party app management, and reduce the installed-app surface on high-value or executive devices - the trade-off is reduced user functionality and increased help-desk friction for legitimate third-party apps, and such restrictions must be paired with a defined exception process. Because the exposed asset is a device identifier rather than account credentials or data content, resetting the device or reinstalling apps does not meaningfully mitigate the issue and should not be treated as an alternative to patching. Note that because the vendor vector rates the issue inconsistently with the assessed local, confidentiality-only impact, teams should prioritize this update according to their standard patch cadence rather than as an emergency outage, and should verify that older hardware unable to reach 26.7/27 is either replaced or explicitly risk-accepted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apple's iOS/iPadOS is a sandboxed mobile operating system in which apps are only permitted to read specific device- and app-scoped identifiers (for example vendor-scoped or advertising identifiers) through mediated, authorization-gated APIs; the CPE string cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:* identifies the whole Apple mobile OS product line as affected rather than a single component. Apple classifies the root cause as an authorization issue addressed with improved state management, which maps to CWE-287 (Improper Authentication): a permission/state check governing access to a device-identifying value could be bypassed or was not correctly retained across application states, letting a sandboxed app obtain a stable fingerprint of the device. Notably, the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) describes a network-reachable, unauthenticated integrity impact, but our independent assessment re-rates it as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N because the attacker must already have code executing locally as an installed app and the demonstrable consequence is limited to reading an identifier - a confidentiality-only, low-severity outcome with no integrity or availability effect. The disagreement is material when triaging: treating this as a remotely exploitable integrity flaw would misallocate remediation effort. ENISA EUVD lists the affected ranges as iOS and iPadOS 0 <26.7 and 0 <27, matching the two fixed release branches.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
A locally installed app (AV:L, PR:L) reads a device identifier - a small confidentiality leak (C:L); no integrity or availability impact, contradicting the vendor's I:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able to fingerprint the device.
Executive ViewAI
Apple iOS and iPadOS devices running versions prior to 26.7 (and prior to 27) contain a device-fingerprinting flaw that allows an already-installed app to obtain a persistent device identifier it is not authorized to read, undermining user privacy controls and enabling cross-app tracking or device re-identification. The exposure is limited to confidentiality of a single identifier - there is no code execution, data modification, or service disruption - and it requires a user to first install a malicious or privacy-invasive app, so practical impact for the organization is contained but carries reputational and privacy-compliance implications for managed mobile fleets. Leadership should care primarily because the fix is already available and remediation is a routine update, not because of imminent operational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB