Skip to main content

Ios And Ipados EUVDEUVD-2026-40211

| CVE-2026-43701 HIGH
Improper Access Control (CWE-284)
2026-06-29 apple GHSA-779r-mf4g-rgf7
Authentication Bypass Apple Ios And Ipados
7.1
CVSS 3.1 · Vendor: apple
View

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 30, 2026

Sandbox escape in Apple's WebKit/Safari web content engine allows a malicious website to process restricted web content outside the sandbox on Safari, iOS/iPadOS, and macOS prior to 26.5.2. Reported by Apple and classed as an improper access-control flaw (CWE-284), it requires a victim to load attacker-controlled content (UI:R) and carries CVSS 7.1 with a scope change, reflecting that breaking out of the sandbox crosses a security boundary. There is no public exploit identified at time of analysis and EPSS is low (0.16%), though CISA's SSVC framework rates the technique as automatable with partial technical impact.

Earlier versions of this analysis (2)
v2 Jun 30, 2026 - 20:28 cvss changed CVSS 7.1

Sandbox escape in Apple Safari and the WebKit engine on iOS, iPadOS, and macOS Tahoe (all versions before 26.5.2) lets a malicious website process restricted web content outside the browser sandbox, weakening the isolation boundary that normally contains untrusted page content. Apple addressed the issue with improved checks and credits its own team for the discovery; there is no public exploit identified at time of analysis and EPSS rates exploitation probability very low at 0.16% (5th percentile). The flaw requires a victim to visit attacker-controlled content (UI:R) but no authentication, and CISA's SSVC framework currently marks exploitation status as none.

v1 Jun 30, 2026 - 13:23 CVSS 8.3

Sandbox escape in Apple's WebKit browser engine (Safari, iOS/iPadOS, and macOS prior to 26.5.2) allows a malicious website to process restricted web content outside the WebKit sandbox, undermining a core browser isolation boundary. Apple addressed it with improved access checks across Safari 26.5.2, iOS/iPadOS 26.5.2, and macOS Tahoe 26.5.2. No public exploit identified at time of analysis, but the scope-changing CVSS 8.3 reflects that escaping the renderer sandbox is a high-value primitive typically chained with a second bug for full compromise.

Affected VersionsENISA

macOS 0 <26.5.2
iOS and iPadOS 0 <26.5.2
Safari 0 <26.5.2

Affected Packages

euvd ios_and_ipados fix: 26.5.2
euvd macos fix: 26.5.2
euvd safari fix: 26.5.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Ios And Ipados gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apple) PRIMARY 7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI 7.1 HIGH

Remote unauthenticated malicious site (AV:N/PR:N) needing victim visit (UI:R); sandbox escape crosses a trust boundary (S:C) with partial impacts (C/I/A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N
SUSE HIGH
Red Hat 7.1 HIGH

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

7
Analysis Updated
Jun 30, 2026 - 20:28 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 30, 2026 - 20:28 vuln.today
v2 - CVSS changed
CVSS changed
Jun 30, 2026 - 20:22 NVD
8.3 (HIGH) 7.1 (HIGH)
CVSS changed
Jun 30, 2026 - 13:22 NVD
8.3 (HIGH)
Patch available
Jun 29, 2026 - 22:02 EUVD
CVE Published
Jun 29, 2026 - 19:43 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 29, 2026 - 19:43 cve.org
HIGH 8.3

DescriptionCVE.org

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. A malicious website may be able to process restricted web content outside the sandbox.

Executive ViewAI

Why It Matters

A sandbox escape vulnerability in Apple Safari (CVE-2026-43701) affects iOS, iPadOS, and macOS devices running versions prior to 26.5.2, enabling malicious websites to execute code with full system privileges and potentially compromise sensitive user data and credentials. Organizations relying on Apple devices for corporate work face significant data exfiltration and account compromise risks until systems are updated. Immediate patching is critical given the scope change that breaks the security boundary.

Recommended Action

Within 24 hours: audit and inventory all macOS, iOS, and iPadOS devices to identify those running Safari versions prior to 26.5.2. Within 7 days: deploy macOS 26.5.2+, iOS 26.5.2+, and iPadOS 26.5.2+ using your organization's MDM solution, prioritizing corporate-managed and high-sensitivity endpoints. Within 30 days: verify patching completion, document compliance in your vulnerability management system, and conduct user security awareness training on the risks of visiting untrusted websites.

Business Impact: High
Compensating Controls

Apply vendor patch. For devices requiring temporary exceptions: restrict Safari to whitelisted corporate domains via MDM policy enforcement, enable network-level blocking of known malicious sites, and increase endpoint detection and response (EDR) alert sensitivity for suspicious child process spawning on unpatched systems.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Ios And Ipados

View all
CVE-2026-86950 HIGH POC
8.8 Sep 28

Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-28952 HIGH POC
7.5 May 11

Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-84561 CRITICAL
9.8 Sep 14

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:42062 ADVISORY https://access.redhat.com/errata/RHSA-2026:42088 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43701 ADVISORY https://vuldb.com/vuln/374719 REF https://support.apple.com/en-us/127594 REF https://support.apple.com/en-us/127595 REF https://support.apple.com/en-us/127685 REF https://support.apple.com/en-us/128068 REF https://support.apple.com/en-us/128069 REF https://support.apple.com/en-us/128070 REF https://support.apple.com/en-us/148287

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy