EUVD-2026-77923
GHSA-vmm8-jwjc-8hh7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryApp runs with normal privileges
-
ExploitAbuse improper access-control check (CWE-284)
-
ExecutionRead sensitive user data
-
ImpactExfiltrate collected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious application already executing locally on the device with normal (non-privileged) app permissions - reflected by CVSS AV:L and PR:L. There is no remote, network, or unauthenticated path and no user interaction beyond installing/running the attacker's app. Exploitation is limited to unpatched versions: iOS/iPadOS below 26.7 (or below 27), macOS Sequoia below 15.8, macOS Tahoe below 26.7, macOS Golden Gate below 27, and visionOS/watchOS below 27. Impact is confidentiality-only (C:H, I:N, A:N) - data read, no modification or denial of service. |
| Impact | Signals align on a modest, locally-gated confidentiality issue, not an urgent priority. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5 Medium) describes a low-privilege app already running on the device that can read sensitive user data - the AV:L means no remote reach and PR:L means an attacker must first land code on the endpoint. EPSS reinforces low practical urgency at 0.20% (10th percentile), and there is no CISA KEV entry and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data is supplied. There is no signal conflict between the network posture stated by CVSS and the description (both point to a local app). The main data-quality caveat is the input Tag 'Authentication Bypass,' which is inaccurate: the CWE-284 (improper access control) info-disclosure primitive involves no credential/authentication bypass. Net: a real but low-severity, defense-in-depth patch - prioritize via routine Apple OS update cadence rather than emergency response. |
| Exploit ScenarioDerived | A user installs a malicious or trojanized app from a third-party channel (or a sideloaded/enterprise-signed build); once running with normal app privileges, the app abuses an access-control gap to read sensitive user data it should not be entitled to. No public exploit code is known, and exploitation requires local execution on the device, so real-world reach is bounded by getting the app onto the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 17, 2026
Improper access control in Apple's iOS, iPadOS, macOS, visionOS, and watchOS allows a locally installed app running with ordinary, non-privileged permissions to read sensitive user data that should be isolated from it. Exploitation requires the attacker to already have a malicious app executing on the device (CVSS 3.1 AV:L/PR:L/UI:N, confidentiality-only C:H/I:N/A:N, base 5.5), so there is no remote or unauthenticated path and no additional user interaction beyond installing and launching the app. Apple addressed the flaw with improved checks, and vendor-released patches are available in iOS/iPadOS 26.7, iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27, and watchOS 27; no public exploit code has been identified and EPSS is low at 0.20% (10th percentile), so this reads as a modest, locally-gated confidentiality issue rather than an urgent priority.
RemediationAI
Apply the vendor-released patches: update to iOS 26.7 or iPadOS 26.7 (or iOS 27 / iPadOS 27), macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, visionOS 27, and watchOS 27 respectively, using the platform-specific Apple advisories at https://support.apple.com/en-us/149034, https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149037, https://support.apple.com/en-us/149038, https://support.apple.com/en-us/149041, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. Because exploitation requires a malicious app already running locally with normal permissions, there is no configuration toggle that closes the access-control gap before patching; compensating controls are therefore preventive and must be weighed against usability costs. Enterprises can enforce a minimum OS version across managed fleets and block installation of apps that fall below it (trade-off: devices that cannot upgrade, especially older macOS and watchOS hardware, get cut off from managed resources). Restricting app installation to the curated App Store and disallowing sideloaded or enterprise-signed builds on high-value devices reduces the main delivery path for the malicious app this flaw depends on (trade-off: it breaks internal distribution of in-house tooling). Deferring OS updates is not a viable mitigation here, and users who cannot patch should be treated as carrying residual data-exposure risk until a supported version is reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-284 (Improper Access Control), an access-control defect in Apple's operating system frameworks where an insufficient permission or entitlement check lets one app reach data owned by another app or by the system. Apple's advisory language - 'addressed with improved checks' - indicates the fix tightens validation of the requesting process's identity/entitlements before the protected resource is returned, rather than correcting a memory-safety bug. The affected CPE records cover four distinct Apple platform families (ios_and_ipados, macos, visionos, watchos), meaning the same class of logic was fixed across the shared codebase used by these operating systems. Because the CVSS vector is AV:L/PR:L with UI:N and the impact is confidentiality-only (C:H/I:N/A:N), the weakness is a sandbox/privacy boundary violation exploited from an already-running local app with normal app-level privileges: the attacker gains read access to sensitive user data but cannot modify it, escalate to full system compromise, or cause a denial of service through this vector alone.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local malicious app (AV:L) running with normal app privileges (PR:L), no user interaction; improper access control yields confidentiality-only data read (C:H, I:N, A:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
This issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB