CVE-2026-43679 Overview
CVE-2026-43679 is an information disclosure vulnerability in Apple watchOS. An attacker with physical access to a locked Apple Watch can view user contacts due to insufficient permissions checking on the lock screen surface. Apple addressed the issue with improved permissions checking in watchOS 26.4. The weakness is tracked under CWE-284: Improper Access Control and requires no user interaction or privileges beyond hands-on possession of the device.
Critical Impact
An attacker holding a locked Apple Watch can enumerate user contacts, exposing personal and organizational relationships without unlocking the device.
Affected Products
- Apple watchOS versions prior to 26.4
- Apple Watch hardware running vulnerable watchOS builds
- Environments where Apple Watch devices sync contacts from paired iPhones
Discovery Timeline
- 2026-08-21 - CVE-2026-43679 published to the National Vulnerability Database
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-43679
Vulnerability Analysis
The vulnerability resides in the watchOS component responsible for gating access to contact records while the device is in a locked state. Improper permissions checking allows contact data to render through an interface reachable without authentication. An adversary with physical possession can trigger the affected path and read stored contact entries.
Exploitation is constrained to the physical attack vector. Network-based abuse is not possible, and the flaw does not yield code execution, data modification, or availability impact. Confidentiality is the sole affected property, and the exposure is limited to contact information available to the watch.
Root Cause
The underlying defect is an access control gap [CWE-284]. The watchOS lock-screen state failed to enforce the permission checks required before returning contact data to a caller. Apple's advisory describes the remediation as "improved permissions checking," indicating the guard logic surrounding the contacts interface was tightened rather than the storage layer itself being modified.
Attack Vector
The attacker must physically hold or manipulate a locked, powered-on Apple Watch. Once in possession, the adversary interacts with the affected surface to display contact records. No pairing, credentials, or companion iPhone access is required. Typical scenarios include lost or stolen watches, unattended devices in offices or fitness environments, and border or checkpoint inspections. See the Apple Support Article for vendor-provided technical context.
Detection Methods for CVE-2026-43679
Indicators of Compromise
- No network-based indicators exist because exploitation requires physical access to the device.
- Reports from users of lost, stolen, or briefly missing Apple Watches should be treated as potential exposure events.
- Unexpected outbound contact from personal or executive contacts may indicate downstream misuse of harvested data.
Detection Strategies
- Track watchOS build versions across enrolled devices via Mobile Device Management (MDM) and flag any device below watchOS 26.4.
- Correlate device loss or theft tickets with the contact set synced to the affected watch to scope potential disclosure.
- Review executive protection and VIP programs for Apple Watch usage patterns that increase physical exposure risk.
Monitoring Recommendations
- Enable MDM compliance policies that report watchOS version drift and quarantine non-compliant devices from corporate mail and contact sync.
- Monitor iCloud and Exchange contact access logs from paired iPhones for anomalies following a reported device loss.
- Audit contact directories synced to Apple Watches to minimize the sensitive data surface accessible from a wrist-worn device.
How to Mitigate CVE-2026-43679
Immediate Actions Required
- Update all Apple Watch devices to watchOS 26.4 or later through the paired iPhone Watch application.
- Enforce a device passcode and enable Wrist Detection so the watch locks automatically when removed.
- Remotely erase or unpair any Apple Watch reported lost or stolen while running a vulnerable build.
Patch Information
Apple resolved CVE-2026-43679 in watchOS 26.4 by introducing improved permissions checking on the affected contacts path. Details are available in the Apple Support Article. Administrators should push the update through MDM watchOS update policies and confirm installation on paired iPhones running iOS 26 or later.
Workarounds
- Restrict contact synchronization to Apple Watch devices for users handling sensitive rosters until the update is applied.
- Require a strong Apple Watch passcode and disable simple 4-digit codes through MDM configuration profiles.
- Educate users to keep the Apple Watch on-wrist or secured, since Wrist Detection re-locks the device upon removal.
# Verify watchOS version on a paired iPhone (Settings path)
# Settings > General > About > Watch Version
# Ensure the reported version is 26.4 or later before returning the device to service.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
