CVE-2026-84626
Apple iOS and iPadOS
LOW 3.3
At a glance
- Source
- NVD
- EPSS
- EPSS 0.15 % · percentile 4 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apple
- NVD status
- Analyzed
Description
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to identify what other apps a user has installed.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://support.apple.com/en-us/149034
- https://support.apple.com/en-us/149035
- https://support.apple.com/en-us/149036
- https://support.apple.com/en-us/149037
- https://support.apple.com/en-us/149038
- https://support.apple.com/en-us/149041
- https://support.apple.com/en-us/149042
- https://support.apple.com/en-us/149043
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | LOW 3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-77927
- GCVE · GCVE-0-2026-84626
CERT-FR advisories
- CERTFR-2026-AVI-1172 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*< 26.7cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*< 26.7cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*≥ 15.0 < 15.8cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*≥ 26.0 < 26.7cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*< 27.0cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*< 27.0cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*< 27.0
Affected products
| Product | Versions |
|---|---|
| Apple · iOS and iPadOS | affected 0 < 26.7 ; affected 0 < 27 |
| Apple · macOS | affected 0 < 15.8 ; affected 0 < 26.7 ; affected 0 < 27 |
| Apple · tvOS | affected 0 < 27 |
| Apple · visionOS | affected 0 < 27 |
| Apple · watchOS | affected 0 < 27 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |