EUVD-2026-49624
GHSA-fmvh-w4vp-v9x9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser opens malicious app
-
DeliveryApp requests sensitive data
-
ExploitAuthorization state bypass
-
ExecutionApp reads data without permission
-
ImpactSensitive data exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The user must interact with a malicious app (UI:R from CVSS). No authentication is required (PR:N), and no special configuration or feature enablement is needed. The vulnerability exists in default configurations of all affected OS versions before 26.6. The requirement for user interaction significantly limits realistic exploitation compared to a fully remote unauthenticated attack. |
| Impact | CVSS 6.5 (Medium) indicates moderate severity with network attack vector and no authentication required, but user interaction is needed. The EPSS score is low (0.16%, percentile 6%), suggesting low exploitation likelihood. SSVC analysis shows no exploitation, not automatable, and partial technical impact (confidentiality only). No evidence of active exploitation or public exploit code exists. Overall real-world risk is low; the vulnerability is not a priority for immediate action but should be patched in routine updates. |
| Exploit ScenarioDerived | An attacker creates a malicious app that, when opened by a user on an unpatched device, exploits the authorization bypass to silently access sensitive data such as contacts, photos, or location history. The user must voluntarily open the app, limiting the attack's reach. No public exploit code has been identified at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
An authorization bypass in Apple iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions before 26.6 allows an app to access sensitive user data without proper permission. The vulnerability requires user interaction (opening a malicious app) and has not been actively exploited, with no CISA KEV listing and a low EPSS probability of 0.16%.
RemediationAI
The primary fix is to update affected devices to the patched versions: iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. No workarounds are documented; users should install available updates via Software Update. Advisory URLs are provided in the affected products section.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an improper authorization (CWE-285) in Apple's operating system permission management. The affected products include multiple Apple OS families as identified by CPE: iOS and iPadOS, macOS, tvOS, visionOS, and watchOS. The root cause is an authorization issue that was addressed with improved state management, meaning the system failed to correctly enforce access controls when an app requested sensitive data, allowing unauthorized access.
Know when Tvos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
User interaction required, no privileges needed, only confidentiality impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
WebKit memory corruption in Safari 18.6 and multiple Apple platforms allows remote code execution when processing malici
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrar
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is low attack comp
Apple kernel lock state checking flaw allows a malicious application to cause unexpected changes in memory shared betwee
An issue was discovered in certain Apple products. Rated high severity (CVSS 7.8), this vulnerability is no authenticati
Apple kernel memory corruption in multiple operating systems allows a malicious application to cause unexpected system t
Out-of-bounds write (CWE-787) in QtWebEngine before 6.10.1-r2 on Alpine Linux, and in other Chromium-based engines such
WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2
On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor repo
Exploit-DB