EUVD-2026-15057
GHSA-qqh3-3q88-f879
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | Despite the absence of a published CVSS score and EPSS value, this vulnerability presents moderate real-world risk based on available signals. The attack vector appears to be local (requiring an app to be installed on the device), which reduces immediate exposure compared to network-based vulnerabilities. However, the Information Disclosure nature combined with access to sensitive user data represents a meaningful privacy impact. The lack of CVSS vector data, KEV status, and exploit proof-of-concept suggests this is either a newly disclosed or responsibly withheld vulnerability with limited active exploitation. The availability of a patch in iOS 26.3 and iPadOS 26.3 indicates Apple addressed this through the normal security update cycle rather than emergency out-of-band patching, suggesting moderate rather than critical severity. Risk prioritization should account for the install base of vulnerable iOS/iPadOS versions and the practical requirement for a malicious app to be present on the device. |
| Exploit ScenarioDerived | A malicious third-party application installed on an iOS or iPadOS device could exploit this input validation flaw to access sensitive user data such as contact information, location history, health data, or authentication credentials without triggering the normal permission prompts or system notifications. The attacker would need to first convince the user to install the malicious app through the App Store or sideloading, but once installed, the flaw would allow the app to bypass sandbox restrictions and read protected data. No public proof-of-concept is available, suggesting this was likely discovered through responsible disclosure rather than active exploitation in the wild. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
An input validation flaw in iOS and iPadOS allows malicious applications to bypass security controls and access sensitive user data without proper authorization. The vulnerability affects iOS and iPadOS versions prior to 26.3, where insufficient input validation in an unspecified component permits unauthorized data disclosure. Apple has patched this vulnerability in iOS 26.3 and iPadOS 26.3, and there are no public indicators of active exploitation or proof-of-concept availability.
RemediationAI
Users should upgrade to iOS 26.3 or iPadOS 26.3 or later immediately. Apple users can initiate the update through Settings > General > Software Update on their device. Until patching is possible, restrict the installation of applications from untrusted sources, review app permissions in Settings > Privacy, and disable installation of apps from developers without established trust. Organizations managing iOS/iPadOS fleets should deploy Mobile Device Management (MDM) solutions to enforce minimum OS version requirements and automate patch deployment. For detailed remediation steps and to access the full security advisory, visit Apple's support page at https://support.apple.com/en-us/126346.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from inadequate input validation in Apple's iOS and iPadOS operating systems, classified as an Information Disclosure issue. The root cause appears to be insufficient sanitization or validation of user-supplied input that fails to properly enforce access controls on sensitive data structures or APIs. While no specific CWE is formally assigned in the available data, the pattern of improved input validation as the remediation suggests this falls within the CWE-20 family (Improper Input Validation) or related categories such as CWE-284 (Improper Access Control). The affected products are identified via CPE string cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, indicating all versions of iOS and iPadOS prior to the patched release are in scope, though the exact vulnerable version range is not explicitly specified in available intelligence.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.
Executive ViewAI
Organizations using This should be aware of moderate risk from CVE-2026-20686, a input validation vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB