CVE-2026-64741: Apple iPadOS Information Disclosure Flaw

CVE-2026-64741 Overview

CVE-2026-64741 is an information disclosure vulnerability affecting multiple Apple operating systems. A local application can read a persistent device identifier due to insufficient permission restrictions. Apple addressed the issue by tightening access controls in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
A malicious application installed on the device can read a persistent hardware or software identifier, enabling cross-app tracking and long-term user fingerprinting that bypasses Apple's privacy controls.

Affected Products

Apple iOS and iPadOS (versions prior to 26.6)
Apple tvOS and visionOS (versions prior to 26.6)
Apple watchOS (versions prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-64741 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64741

Vulnerability Analysis

The issue allows an application running on the device to access a persistent device identifier that should be gated by stricter permission checks. Persistent identifiers on Apple platforms are protected because they enable long-term tracking of a specific device across app installs, resets, or user sessions. Apple's advisories describe the fix as adding additional restrictions to the permission model rather than removing the identifier from the system entirely.

Successful exploitation requires local code execution on the device, typically through an installed application, and depends on user interaction to launch that application. The confidentiality impact is high because the leaked identifier can be correlated across services, but data integrity and availability are unaffected.

Root Cause

The root cause is a permissions issue in the subsystem exposing the persistent identifier. The API path returning the value did not enforce the entitlement or privacy check required to authorize the caller. Apple's remediation adds additional restrictions to close this gap.

Attack Vector

An attacker distributes a malicious or over-privileged application through the App Store, an enterprise distribution channel, TestFlight, or a sideloading mechanism. Once the user launches the app, it queries the vulnerable interface and receives the persistent identifier. The identifier can then be exfiltrated to attacker infrastructure and used to build tracking profiles or link previously anonymous datasets.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the Apple security advisories referenced below rather than in sample exploit code.

Detection Methods for CVE-2026-64741

Indicators of Compromise

Applications transmitting stable identifier strings to non-Apple endpoints shortly after first launch, especially over TLS to newly registered domains.
Repeated API calls from a single app to the vulnerable identifier interface across sessions.
Presence of installed apps with mismatched entitlements or unexpected privacy-sensitive API usage disclosed in App Privacy Reports.

Detection Strategies

Review App Privacy Reports on managed iOS/iPadOS devices for apps contacting unexpected tracking or telemetry domains.
Correlate mobile telemetry from mobile device management (MDM) platforms with app inventory to flag devices running vulnerable OS builds below version 26.6.
Inspect network traffic from managed devices for outbound identifier-like payloads sent immediately after app launch events.

Monitoring Recommendations

Track OS version compliance across the fleet and alert when devices remain below iOS/iPadOS/tvOS/visionOS/watchOS 26.6.
Monitor MDM logs for newly installed applications from untrusted publishers on devices that have not yet been patched.
Baseline outbound traffic from mobile devices and alert on newly observed domains receiving persistent tokens from client applications.

How to Mitigate CVE-2026-64741

Immediate Actions Required

Update all Apple devices to iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6 or later.
Enforce the minimum patched OS version through MDM compliance policies and block non-compliant devices from corporate resources.
Audit installed applications and remove any that are unnecessary, unmaintained, or sourced outside approved distribution channels.

Patch Information

Apple has released fixes in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Refer to the vendor advisories for build-specific details: Apple Security Announcement #128066, Apple Security Announcement #128068, Apple Security Announcement #128069, and Apple Security Announcement #128070.

Workarounds

Restrict app installation to vetted App Store or MDM-approved sources until patches are deployed.
Disable or remove applications from unknown developers that request broad device or telemetry access.
Apply MDM restriction profiles that limit sideloading and enterprise app trust on unpatched devices.

bash

# Example MDM compliance rule (pseudocode) enforcing minimum OS version
compliance_policy:
  platform: iOS
  minimum_os_version: "26.6"
  action_on_noncompliance: block_corporate_access