EUVD-2026-49478
GHSA-8h99-r879-98w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious link
-
DeliveryDeliver via email or web
-
ExploitUser clicks/interacts
-
ExecutionTrigger UI state inconsistency
-
PersistBypass network filters
-
ImpactIntegrity compromise
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The vulnerability requires user interaction (UI:R from CVSS vector), meaning the attacker must persuade the victim to perform an action such as clicking a link or opening a specially crafted file. No special configuration is needed; the flaw affects default installations of the affected OS versions. The attack is unauthenticated (PR:N). Limiting factors: the user must be tricked into interacting, and the attack is only possible via network-accessible content (e.g., web browsing, email). No other prerequisites are specified. |
| Impact | CVSS 3.1 base score 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a network-accessible attack requiring user interaction, with high integrity impact but no confidentiality or availability loss. The EPSS score of 0.27% (20th percentile) is low, suggesting a very low probability of exploitation in the wild. The SSVC framework yields 'Exploitation: none, Automatable: no, Technical Impact: partial', further lowering real-world risk. Despite a moderate CVSS, the requirement for user interaction and absence of active exploitation (no KEV, no public exploit code) make this a lower priority for urgent patching, though it should still be addressed in routine updates. |
| Exploit ScenarioDerived | An attacker crafts a malicious webpage that, when visited by a user on an affected iOS, iPadOS, or macOS device, triggers the inconsistent UI state to bypass network filters. No authentication is needed, and the attack relies on the user clicking a link or loading the content, for example in a phishing email or a malicious ad. As no public exploit code has been identified, this scenario remains theoretical but is feasible based on the vulnerability description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
An inconsistent user interface state management in multiple Apple operating systems allows remote attackers to bypass network filters, potentially leading to unauthorized actions on the system. The vulnerability requires user interaction (e.g., clicking a link) and affects iOS and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No active exploitation has been reported at this time, and the EPSS score (0.27%, 20th percentile) indicates a low immediate threat.
RemediationAI
Vendor-released patch: upgrade iOS and iPadOS to version 26.6, macOS Sequoia to 15.7.8, macOS Sonoma to 14.8.8, macOS Tahoe to 26.6, tvOS to 26.6, watchOS to 26.6, and visionOS to 26.6. No workarounds have been published; applying the latest OS updates via Apple's Software Update mechanism is the recommended remediation. Confirm installation through the device's settings or MDM tools.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-451, which covers user interface (UI) misrepresentation of critical information. The root cause is an inconsistent UI state management flaw, where the interface fails to properly reflect security-relevant states, enabling an attacker to deceive the UI into applying incorrect network filter rules. The CPE data confirms affected products span the entire Apple mobile and desktop ecosystem, including iOS/iPadOS, macOS, tvOS, visionOS, and watchOS. This class of vulnerability often arises from race conditions or incomplete state transitions in the UI layer, leading to security policy bypasses.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Requires user interaction, network accessible, no privileges, integrity impact only.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote attacker may be able to bypass network filters.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB