EUVD-2026-15164
GHSA-jffc-gvjg-4h86
Vulnerability Assessment
| Impact | While a CVSS score and EPSS exploitation probability are not currently published, the vulnerability demonstrates moderate real-world risk due to its broad attack vector (any app on the system can exploit it) and the direct privacy impact. The attack requires no special privileges beyond normal app installation, making it highly automatable. The vulnerability is not listed as actively exploited in KEV databases, and no public proof-of-concept is known to exist. However, Apple's decision to patch across six major operating systems simultaneously indicates they considered the privacy implications serious enough to warrant rapid remediation. The lack of quantified severity metrics suggests this may have been patched proactively rather than in response to active exploitation, though the information disclosure capability itself is technologically straightforward to weaponize for reconnaissance. |
| Exploit ScenarioDerived | A malicious app submitted to the App Store uses newly installed system queries to enumerate all apps on a user's device, then reports the list to an attacker's command-and-control server. The attacker correlates this data with millions of other users to build a profile of common app combinations, identifying victims who have specific banking, health, or sensitive applications installed. This reconnaissance data enables targeted phishing, malware delivery, or social engineering attacks. The attack requires only network connectivity and no special permissions, making it easily automatable across infected devices. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
An information disclosure vulnerability in Apple's operating systems allows applications to enumerate a user's installed apps without proper authorization. This affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions prior to 26.4. An attacker can distribute a malicious app that queries the system to discover what applications a user has installed, potentially enabling targeted attacks or privacy violations. No CVSS score, EPSS data, or known public exploits are currently documented, but the vulnerability has been fixed across all Apple platforms, indicating Apple assessed this as requiring immediate remediation.
RemediationAI
Immediately update all Apple devices to version 26.4 or later: upgrade iOS and iPadOS to 26.4, macOS to Tahoe 26.4, tvOS to 26.4, visionOS to 26.4, and watchOS to 26.4. Complete patch availability across all platforms means no interim workarounds are necessary. Users should enable automatic software updates to receive the fix immediately. Organizations with supervised device management should deploy forced updates to macOS and iOS devices. Reference Apple's security advisories at https://support.apple.com/en-us/126792 (iOS/iPadOS), https://support.apple.com/en-us/126794 (macOS), https://support.apple.com/en-us/126797 (tvOS), https://support.apple.com/en-us/126798 (visionOS), and https://support.apple.com/en-us/126799 (watchOS) for release notes and deployment guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Apple's app enumeration mechanisms across their entire ecosystem (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). The root cause is classified as an information disclosure issue (CWE category), stemming from insufficient access controls on APIs or system calls that expose the list of installed applications. Affected CPE entries span cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:tvos, cpe:2.3:a:apple:visionos, and cpe:2.3:a:apple:watchos. The vulnerability allows third-party applications to bypass privacy protections that should restrict visibility into a user's installed app inventory, a fundamental iOS/macOS security model principle that prevents profiling and targeted exploitation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
This issue was addressed with improved checks. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to enumerate a user's installed apps.
Executive ViewAI
Organizations using This should be aware of moderate risk from CVE-2026-28882 rated CVSS 4.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB