EUVD-2026-49627
GHSA-9494-q35c-mv5p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDistribute malicious app via social engineering or sideloading
-
ExploitUser installs and launches the app
-
ExecutionApp exploits authorization flaw in state management
-
ImpactApp reads sensitive user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | A local app execution environment on an unpatched iOS or iPadOS device (version <26.6) is required. User interaction is needed to launch the malicious app, as indicated by AV:L and UI:R. No specific configuration, feature, or permission is necessary; the vulnerability exists in the default state. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) rates this 5.5 (Medium). Exploitation requires local execution of a malicious app and user interaction, which severely limits the attack surface. EPSS predicts a 0.14% probability of exploitation, aligning with the SSVC assessment of no current exploitation and non-automatable exploitation. Technical impact is partial, confined to confidentiality. This is a typical local information disclosure with low practical risk given Apple's app sandbox and App Store review, though sideloaded or enterprise-signed apps could theoretically trigger it. |
| Exploit ScenarioDerived | An attacker distributes a malicious app outside the App Store and convinces a victim to install and launch it on an unpatched device. Once the app runs, it exploits the authorization flaw to read sensitive data such as contacts or photos. No special permissions are required, only that the victim interacts with the app. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Information disclosure in iOS and iPadOS versions before 26.6 allows a locally installed malicious application to access sensitive user data without proper authorization. Apple addressed the flaw in iOS 26.6 and iPadOS 26.6 with improved state management; no active exploitation or public proof-of-concept has been identified. The EPSS exploitation probability is low (0.14%), consistent with the local attack vector and required user interaction.
RemediationAI
Update to iOS 26.6 or iPadOS 26.6 as specified in Apple's advisory (https://support.apple.com/en-us/128066). No workarounds are documented. Users should refrain from sideloading untrusted apps or installing enterprise profiles from unknown sources until the update is applied, as these bypass App Store review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the operating system's state management for app authorization and is classified as CWE-200 (Exposure of Sensitive Information). The affected product, as indicated by the CPE string 'cpe:2.3:a:apple:ios_and_ipados', encompasses all iOS and iPadOS releases prior to the fix. The issue likely involves improper handling of app state transitions or permission checks, enabling an app to read data it should not normally access.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local attack via a malicious app with no privileges needed; user must launch the app; only confidentiality is impacted.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB