EUVD-2026-15161
GHSA-wh29-fhm6-hqrh
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Without a published CVSS score or vector, risk assessment relies on available signals: the vulnerability is categorized as Information Disclosure with tags spanning iOS, iPadOS, macOS across multiple versions, and visionOS, indicating broad platform impact. The fix deployment across six distinct security advisories (references 126792-126796, 126799) suggests Apple considered this a significant cross-platform concern warranting immediate patching. The attack vector appears to be local (requires app installation), but the low-complexity enumeration of installed apps has moderate real-world risk for privacy-focused users and organizations managing sensitive device inventories. KEV and EPSS data are not available, but the breadth of affected versions and the privacy implications (fingerprinting, targeted exploit chain building) suggest moderate priority. This is not a critical remote code execution, but it removes a security boundary that users reasonably expect to protect their application landscape from enumeration by untrusted apps. |
| Exploit ScenarioDerived | A malicious application installed on a user's iPhone could silently query the system to enumerate all installed apps, identifying productivity apps (banking, cryptocurrency wallets, health apps), security tools, and messaging platforms without requesting permissions. The attacker could use this data to profile the user's device for vulnerability targeting (e.g., if a vulnerable app version is detected) or to serve context-aware phishing attacks. A single-stage app compromised via supply chain attack could exfiltrate device fingerprints to command infrastructure, combining app enumeration with other system queries to build a comprehensive target profile across thousands of devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A permissions enforcement vulnerability in Apple operating systems allows unauthorized enumeration of installed applications on a user's device. This information disclosure issue affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, iOS 26.4 and earlier, iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier. An attacker with the ability to execute code as an installed application could enumerate the complete list of user-installed applications without explicit user permission, enabling targeted attacks, privacy violations, and device profiling.
RemediationAI
Users and administrators should immediately update affected devices to the patched versions: iOS and iPadOS 18.7.7 or later, iOS and iPadOS 26.4 or later, macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, macOS Tahoe 26.4 or later, and visionOS 26.4 or later. For iOS/iPadOS, enable automatic updates via Settings > General > Software Update > Automatic Updates. For macOS, open System Settings > General > Software Update and apply updates immediately. Additionally, review installed applications for suspicious or unnecessary apps that may have been installed by users unaware of enumeration risks. Organizations should enforce mobile device management (MDM) policies to mandate prompt patching and restrict sideloading of untrusted applications. Users can mitigate interim risk by avoiding installation of applications from untrusted sources until patches are deployed. Refer to Apple's official security advisories at https://support.apple.com/en-us/126792 through 126799 for version-specific patch details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from insufficient permission validation in Apple's application enumeration APIs across multiple operating systems. The root cause involves inadequate access control checks that fail to properly restrict an application's ability to query the system's installed application database. This affects the following products as identified through CPE matching: cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:visionos. The vulnerability is classified as an Information Disclosure issue (CWE category related to improper restriction of rendered UI layers or unintended content exposure). The flaw exists in the permission boundary enforcement mechanisms that should isolate applications from accessing system-wide application inventory without explicit sandbox exceptions or user grants.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps.
Executive ViewAI
Organizations using A permissions should be aware of notable risk from CVE-2026-28880, a improper access control vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Apple iOS and iPadOS 26.4 Security Issues
View all 10Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB