What is the CVSS score of EUVD-2026-49457?

EUVD-2026-49457 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-49457?

Within 24 hours, identify all Apple devices (macOS, iOS, iPadOS) running versions prior to 26.6 and begin planning an emergency patch deployment. Over the next 7 days, test the vendor-released patch (version 26.6) in a controlled environment and deploy to all managed devices. Within 30 days, verify full patch coverage and ensure no unpatched systems remain, while monitoring for any signs of exploitation attempts leveraging this vulnerability.

Tvos EUVD-2026-49457

Q: Which versions of Tvos are affected by EUVD-2026-49457?

A code signing bypass vulnerability in Apple operating systems allows a malicious app to execute with high confidentiality and integrity impact, potentially leading to data breaches or system…. A patch is available.

| CVE-2026-43813 HIGH

Improper Input Validation (CWE-20)

2026-07-27 apple

GHSA-5vm7-4m77-64jv

Authentication Bypass Apple Tvos Visionos Watchos Ios And Ipados

7.1

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (apple) · only source for this CVE.

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 15:26 vuln.today

CVSS changed

Jul 28, 2026 - 15:22 NVD

7.1 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:14 cve.org

HIGH 7.1

DescriptionCVE.org

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement.

AnalysisAI

A code signing enforcement bypass in Apple operating systems allows a maliciously crafted app to execute with high confidentiality and integrity impact. No active exploitation is reported, and the EPSS score of 0.17% indicates a low probability of weaponization. Apple has released patches in version 26.6 for all affected platforms.