EUVD-2026-77910
GHSA-p59r-2cp8-97mr
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate-severity, low-priority local privilege/authorization flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) shows the only path is a LOCAL, already-installed malicious or compromised app (PR:L) that reads sensitive user data - there is no network vector and no integrity or availability impact. EPSS reinforces low real-world urgency at 0.19% (9th percentile). It is NOT in CISA KEV and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Signals are consistent, not conflicting: low EPSS, no KEV, no POC, local-only vector, confidentiality-only impact all point the same direction. The one metadata concern is the 'Authentication Bypass' tag, which overstates the issue - CWE-285 improper authorization here is an access-control/information-disclosure bug, not a credential/authentication bypass. Net: a legitimate patch-worthy issue given the ubiquity of Apple platforms, but a routine-priority OS-update item rather than an emergency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Improper access control in Apple iOS, iPadOS, and macOS lets a locally installed application running with low privileges read sensitive user data, with no user interaction required, affecting iOS and iPadOS before 26.7 and before 27 and macOS before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27. Apple fixed the authorization flaw (CWE-285) through improved access control as part of its 26.7/27 release cycle, so vendor patches are available for every affected platform. At a CVSS base score of 5.5 and an EPSS score of only 0.19% (9th percentile), this is a moderate-severity, low-priority local authorization issue; no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patches are available: upgrade iOS and iPadOS to 26.7 or to 27, and macOS to Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, using the platform-specific Apple advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149041, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043 to confirm the build for each device family. Because exploitation requires only a low-privileged local app and no user interaction, the practical interim controls are application-centric rather than network-centric: enforce a vetted-app-only policy (managed allowlisting or MDM restrictions on sideloading, enterprise-signed apps, and untrusted TestFlight builds) to reduce the pool of processes that could exercise the missing authorization check, and audit installed apps and entitlements for unexpected high-privilege capabilities; the trade-off is reduced user and developer flexibility and ongoing administrative overhead, and it only narrows the attack surface rather than closing the flaw. Standard network controls such as firewalling or segmentation provide no meaningful mitigation here because the vector is strictly local. Until devices are patched, treat data stored on affected iPhones, iPads, and Macs as exposed to any locally running app, and prioritize updates on devices holding the most sensitive user data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classed as CWE-285, Improper Authorization, meaning the operating system failed to correctly validate that a calling process is entitled to reach a protected resource before granting access. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N describes the exploitation profile precisely: the attack must be launched locally (AV:L), the attacker needs low privileges on the device (PR:L, i.e. an app already running in the user context rather than a fully unprivileged remote party), no user interaction is needed (UI:N), the scope is unchanged (S:U), and the outcome is a high confidentiality impact with no integrity or availability effect - a pure data-exposure primitive. In Apple's architecture this class of bug typically concerns the boundary between the app sandbox, app entitlements, and protected user data such as files, databases, or account information managed by system daemons; the fix noted in the advisories is an access-control hardening rather than a memory-safety change. CPE data confirms the affected platform families are apple:ios_and_ipados and apple:macos, and ENISA EUVD (EUVD-2026-77910) enumerates the vulnerable ranges as iOS/iPadOS 0 to before 26.7, iOS/iPadOS 0 to before 27, and macOS 0 to before 27, 0 to before 26.7, and 0 to before 15.8, matching the fixed releases named in the Apple advisories.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB