EUVD-2026-77964
GHSA-wxc5-2jg8-734h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDistribute malicious app to device
-
DeliveryUser installs and runs app
-
ExploitApp reads exposed sensitive data
-
ExecutionDerive persistent device fingerprint
-
ImpactTrack/de-anonymize user across apps
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
|
| Exploitation Conditions | Requires a malicious or privacy-abusing app to be installed and executed on the target iOS/iPadOS device (version below 26.6); this is on-device local execution, not remote network exploitation despite the supplied AV:N vector. No additional privileges, entitlements, or user interaction beyond running the app are stated. Limiting factors: the attacker must get an app onto the device (App Store review, sideloading, MDM/enterprise provisioning, or TestFlight), and the impact is limited to user fingerprinting/tracking rather than arbitrary data access, code execution, or system compromise. Devices already updated to iOS/iPadOS 26.6 are not affected. |
| Impact | This is a privacy/fingerprinting flaw (CWE-359) in Apple iOS/iPadOS, fixed in 26.6, that Apple describes as 'An app may be able to fingerprint the user.' The signals conflict sharply. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N = 7.5) models a remote, unauthenticated, high-confidentiality issue - but the description clearly requires a malicious app already running ON the device, which is local execution, not network reach. AV:N is therefore very likely mis-scored (should be AV:L), and C:H overstates the impact: fingerprinting exposes stable device/user identifiers for cross-app tracking, not bulk sensitive data, which is a LOW confidentiality outcome. Exploitation signals are benign: EPSS 0.14% (4th percentile), not in CISA KEV, and no public exploit code identified. Net: this is a nominal 7.5 that behaves like a low-to-moderate privacy hardening fix - a real defense-in-depth improvement against tracking, not an urgent RCE-class priority. It matters most to privacy-sensitive users and App Store review integrity rather than as a mass-exploitation threat. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from the App Store or via sideloading/enterprise distribution; the app reads sensitive data that was accessible to it and derives a persistent identifier that survives resets and links the user across apps and sessions. No public proof-of-concept exists, and the attack yields tracking/de-anonymization rather than data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. Exploitation requires getting a malicious or privacy-abusing app onto the device via the App Store, sideloading, MDM/enterprise provisioning, or TestFlight, and devices already updated to iOS/iPadOS 26.6 are not affected. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.14% (4th percentile).
RemediationAI
Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, which Apple states fixes the issue by moving sensitive data; the advisory is at https://support.apple.com/en-us/128066. Because the flaw is exploited only by an app already installed on the device, update priority should be balanced against the low EPSS signal (0.14%, 4th percentile) and the absence of any KEV listing or public exploit code. Where immediate fleet-wide updates are not feasible, the effective compensating control is app-installation hygiene: enforce MDM policies that restrict app installation sources, disable side-loading and user-initiated TestFlight installs on managed devices, and review enterprise provisioning so only vetted apps reach the device - recognizing the trade-off that this reduces user flexibility and requires ongoing app-catalog maintenance. Restricting the ability to install arbitrary apps directly addresses the assessed prerequisite (a malicious or privacy-abusing app must run locally), but it does not remediate already-installed malicious apps or previously fingerprinted users, so devices on versions below 26.6 should still be updated as the only complete fix. Note that no network-side control exists for this issue, since the assessed attack vector is local application execution rather than remote exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-359, Exposure of Private Personal Information to an Unauthorized Actor, in this case surfacing within the iOS/iPadOS application sandbox: sensitive data that an app could previously read was accessible in a way that let the app combine it into a stable device/user identifier. Apple's fix, per the advisory, is to relocate that sensitive data so it is no longer reachable for fingerprinting purposes. Fingerprinting differs from a single leaked secret because it relies on the persistence and stability of identifiers, so mitigations must remove the ability to derive a durable identity rather than just obscure one value. Apple's CPE entry (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*) confirms the iOS and iPadOS platform line as the affected technology, covering all versions below 26.6. The impacted component is the operating-system privacy boundary exposed to third-party apps, and the fix is delivered solely through the OS update chain, not through any separable library or service. Notably, the supplied CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector implies remote, high-impact confidentiality loss, but the independent assessment re-scores it as AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting that a locally executed app is required and that the consequence is low-severity tracking rather than high-impact data exposure.
Know when Ios And Ipados gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitation requires a locally installed/running app (AV:L), needs no special privileges (PR:N); fingerprinting exposes limited identifiers so C:L, with no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.
Executive ViewAI
CVE-2026-28938 is a privacy flaw in Apple iOS and iPadOS versions earlier than 26.6 that lets an installed application fingerprint and track the device owner, affecting corporate-owned and BYOD iPhones and iPads in managed fleets. The impact is limited to tracking and profiling rather than data theft, code execution, or device compromise, but it creates regulatory and reputational exposure for organizations that process regulated or sensitive data on mobile devices. A vendor patch is available, no public exploit code has been identified, and there is no confirmed active exploitation, so this is a manageable patch-management and privacy-governance issue rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ios And Ipados
View allOut-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
Integer overflow in Apple operating systems allows remote unauthenticated attackers to crash devices via maliciously cra
An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
Exploit-DB