What is the CVSS score of EUVD-2026-49496?

EUVD-2026-49496 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-49496?

Yes, a patch is available for EUVD-2026-49496. Update the affected software to the latest version immediately.

macOS EUVD-2026-49496

| CVE-2026-64745 LOW

Improper Authentication (CWE-287)

2026-07-27 apple

GHSA-9jmj-p624-q22c

Authentication Bypass Apple

2.4

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

2.4 LOW

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.4 LOW

Physical attack vector, low complexity, no privileges required, only partial confidentiality impact on contacts and photos.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:54 vuln.today

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

LOW 2.4

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical access to a locked device may be able to access contacts and photos.

AnalysisAI

Authentication bypass via lock screen in macOS allows a person with physical access to view contacts and photos on a locked device. The issue affects macOS prior to Sequoia 15.7.8 and Tahoe 26.6. No active exploitation or public exploit code is reported, but the vulnerability bypasses a fundamental security boundary.

Technical ContextAI

The macOS lock screen is intended to prevent unauthorized access to sensitive user data when a device is in a locked state. CWE-287 (Improper Authentication) indicates a logic flaw that allowed bypasses of this authentication mechanism, granting access to contacts and photos without proper credentials. The vulnerability resides in the macOS user interface and authentication subsystem, as indicated by the CPE for Apple macOS.

RemediationAI

Upgrade to macOS Sequoia 15.7.8 or macOS Tahoe 26.6 (or later) as specified in Apple's security advisories https://support.apple.com/en-us/128067 and https://support.apple.com/en-us/128071. No technical workaround is provided; the fix introduces additional lock screen restrictions. If patching is delayed, enforce strict physical access controls, but this relies on operational diligence and does not eliminate the underlying risk.