iOS and iPadOS EUVD-2026-60494

Exploitation requires a malicious app to be installed on the target device and actively launched by the user (UI:R), consistent with the local attack vector (AV:L) and required user interaction in the CVSS vector. The attacker must have a means to deliver the app to the victim device - either via a social engineering campaign, MDM profile abuse, or a compromised App Store submission. Low privilege (PR:L) indicates no elevated or administrative access is needed beyond that of a normal installed application. Exploitation is limited to devices running iOS/iPadOS below 26.6.1 or macOS Tahoe below 26.6.2; devices already updated are not affected. There is no evidence this can be triggered remotely without the app being present, and no network exposure vector has been confirmed.

The CVSS 3.1 base score of 5.0 (Medium) is driven by local access requirement (AV:L), low privilege (PR:L), and required user interaction (UI:R), which together meaningfully limit exploitability compared to network-facing remote-code-execution issues. The high confidentiality impact (C:H) is the score's most significant component and reflects the potential seriousness of sensitive data exposure - which on mobile platforms could include health data, location history, credentials, or messages. EPSS at 0.17% (7th percentile) further corroborates that mass exploitation is unlikely; the vulnerability is not listed in the CISA KEV catalog and no POC has been identified. The practical threat model centers on a malicious app - either sideloaded or approved by a corporate MDM - that a user actively runs, making this a realistic but targeted threat rather than opportunistic internet-scale exploitation. Overall, this is a genuine medium-priority patch rather than an emergency response item; organizations with high-sensitivity mobile fleets (healthcare, finance, government) should prioritize updates.

An attacker distributes a malicious app - for example, through a phishing campaign directing users to install an enterprise-signed IPA, or by submitting a crafted app to the App Store - that, when launched by the victim, exploits the logic flaw in Apple's protection mechanism to read sensitive user data such as contacts, health records, or authentication tokens outside its sandbox entitlements. No public exploit code has been identified, making this scenario more plausible for targeted attacks than widespread opportunistic campaigns.