CVE-2026-43657: iOS/iPadOS App Enumeration Vulnerability

CVE-2026-43657 Overview

CVE-2026-43657 is a permissions vulnerability affecting Apple iOS and iPadOS. A malicious application installed on an affected device can enumerate the list of other installed applications. Apple addressed the issue by imposing additional restrictions on the affected permission model. The flaw is categorized under [CWE-269] Improper Privilege Management and requires local access with low privileges. Apple resolved the issue in iOS 26.5 and iPadOS 26.5.

Critical Impact
A malicious app running on an affected iOS or iPadOS device can enumerate the inventory of installed applications, exposing user data useful for targeted phishing, fingerprinting, and follow-on attacks.

Affected Products

Apple iOS versions prior to 26.5
Apple iPadOS versions prior to 26.5
Third-party applications relying on the affected permission model for isolation

Discovery Timeline

2026-08-25 - CVE-2026-43657 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-43657

Vulnerability Analysis

The vulnerability stems from insufficient permission enforcement within iOS and iPadOS. A sandboxed application can query APIs or system state that reveal which other applications are installed on the device. Apple's application sandbox is designed to prevent apps from inspecting the presence of unrelated applications without explicit entitlement. The flaw breaks this expectation and allows enumeration to occur without a corresponding authorization check.

App enumeration is a low-severity information disclosure, but it enables downstream attacks. Threat actors can profile a user's installed applications to identify banking apps, enterprise mobility tools, cryptocurrency wallets, or messengers. That inventory then informs targeted phishing lures, tailored social engineering, and selection of exploits for subsequently observed apps.

Root Cause

The root cause is improper privilege management [CWE-269] in the affected iOS and iPadOS components. The system granted implicit visibility to installed app metadata without validating that the requesting process held the necessary entitlement. Apple's advisory states the issue was addressed by adding restrictions to the permission check enforced when apps query installed-application state.

Attack Vector

Exploitation requires a malicious or compromised application to be installed on the target device. The attacker cannot exploit the flaw remotely and does not require user interaction beyond the initial app installation. Once installed, the malicious app invokes the affected system interfaces to enumerate installed applications and exfiltrate the list to an attacker-controlled server. See the Apple Support Article for vendor-specific technical detail.

Detection Methods for CVE-2026-43657

Indicators of Compromise

Applications making unexpected outbound network requests shortly after installation, containing serialized lists of bundle identifiers.
Mobile Device Management (MDM) telemetry showing installed apps that request URL scheme queries or LSApplicationQueriesSchemes entries inconsistent with their stated purpose.
Application binaries invoking private or undocumented APIs related to installed-application discovery.

Detection Strategies

Review App Store and enterprise-distributed applications for behaviors that enumerate installed apps beyond declared use cases.
Correlate mobile threat defense (MTD) alerts with newly installed applications that trigger sandbox anomaly warnings.
Inspect network egress from managed iOS and iPadOS devices for patterns consistent with device fingerprinting payloads.

Monitoring Recommendations

Enforce MDM policies that report installed application inventory and OS version compliance for iOS 26.5 and iPadOS 26.5.
Monitor for devices that remain on pre-26.5 OS builds and prioritize them for upgrade.
Log DNS and TLS metadata from mobile fleet egress points to identify beaconing associated with sideloaded or high-risk apps.

How to Mitigate CVE-2026-43657

Immediate Actions Required

Update all iPhone devices to iOS 26.5 or later and all iPad devices to iPadOS 26.5 or later.
Push the update through MDM to enforce compliance across managed fleets.
Audit installed applications on high-value user devices for apps that request broad query entitlements.

Patch Information

Apple resolved CVE-2026-43657 in iOS 26.5 and iPadOS 26.5 by tightening the permission checks that gate access to installed-application enumeration. Refer to the Apple Support Article for the full advisory and release notes.

Workarounds

Restrict installation to vetted App Store applications and block sideloading through MDM configuration profiles.
Remove low-trust applications from managed devices until the OS update is applied.
Educate users to avoid installing applications from unknown developers or untrusted sources.

bash

# Example MDM compliance query to identify devices requiring the update
# Flag any device running iOS or iPadOS below 26.5
device.os_version < "26.5" AND device.platform IN ("iOS", "iPadOS")