CVE-2026-64742: Apple iPadOS Information Disclosure Flaw

CVE-2026-64742 Overview

CVE-2026-64742 is a cleartext transmission vulnerability [CWE-319] affecting multiple Apple operating systems. The flaw allowed an app to access sensitive user data because information was sent over the network without HTTPS. Apple addressed the issue by enforcing HTTPS for the affected network communication. The vulnerability requires user interaction and can be triggered over the network, exposing confidential data in transit.

Critical Impact
An app running on an affected Apple device may access sensitive user data transmitted in cleartext over the network, enabling passive interception by an attacker positioned on the same network path.

Affected Products

Apple iOS and iPadOS versions prior to 26.6
Apple tvOS, visionOS, and watchOS versions prior to 26.6
Apple devices running earlier releases across iphone_os, ipados, tvos, visionos, and watchos

Discovery Timeline

2026-07-27 - CVE-2026-64742 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-64742

Vulnerability Analysis

The vulnerability stems from an Apple platform component transmitting sensitive user data over an unencrypted network channel. Because the data traversed the network without Transport Layer Security (TLS), any adversary with access to the network path could observe the traffic. This class of weakness is tracked as Cleartext Transmission of Sensitive Information [CWE-319].

Apple resolved the flaw by switching the affected network requests to HTTPS. The fix is included in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Apple's advisories do not disclose the exact component or protocol prior to the change.

Exploitation requires user interaction, and impact is limited to confidentiality. Integrity and availability are unaffected. The EPSS score at publication was 0.196%, indicating a low probability of near-term exploitation activity.

Root Cause

The root cause is the use of plaintext HTTP, or an equivalent unencrypted transport, for a network operation that carried sensitive user data. Without TLS, no confidentiality or endpoint authentication protects the payload in transit. An installed application on the device could read or observe the data as it traversed the network stack.

Attack Vector

An attacker leverages an application on the affected device, or a network position between the device and a remote endpoint, to intercept the cleartext traffic. Because the attack surface is network-based and involves data disclosure, exploitation does not require elevated privileges. It does, however, depend on user interaction such as launching an app or performing an action that triggers the vulnerable network call.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in Apple's security advisories referenced below.

Detection Methods for CVE-2026-64742

Indicators of Compromise

Outbound HTTP (port 80) connections from Apple mobile devices to endpoints that normally require HTTPS, observed prior to patching
Unencrypted traffic containing session identifiers, tokens, or personally identifiable information originating from managed iOS, iPadOS, tvOS, visionOS, or watchOS devices
Application traffic captures from Mobile Device Management (MDM) network inspection tools showing plaintext payloads with user data fields

Detection Strategies

Inspect network telemetry for cleartext connections from Apple device fleets and correlate against the OS build reported by MDM
Deploy TLS enforcement policies at the network egress and alert on non-TLS traffic from mobile subnets
Cross-reference device inventory against the fixed builds (26.6) to identify unpatched endpoints exposed to the flaw

Monitoring Recommendations

Ingest firewall, proxy, and NetFlow logs into a centralized analytics platform and baseline expected TLS ratios per device class
Track MDM compliance reports for iOS, iPadOS, tvOS, visionOS, and watchOS to confirm 26.6 adoption
Monitor for anomalous outbound destinations from Apple devices that could indicate a rogue app abusing the cleartext channel

How to Mitigate CVE-2026-64742

Immediate Actions Required

Update all affected Apple devices to iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, or watchOS 26.6
Enforce update compliance through MDM policies and block non-compliant devices from sensitive corporate resources
Require enterprise applications to use HTTPS with certificate validation and App Transport Security (ATS) enabled

Patch Information

Apple released fixes in iOS 26.6, iPadOS 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The change replaces cleartext network communication with HTTPS. Refer to Apple's advisories for the specific builds and release notes: Apple Support Advisory #128066, Apple Support Advisory #128068, Apple Support Advisory #128069, and Apple Support Advisory #128070.

Workarounds

Route mobile device traffic through a VPN that provides an encrypted tunnel until patches are applied
Restrict use of untrusted Wi-Fi networks on affected devices, particularly public hotspots
Enforce ATS exceptions review for internal iOS applications and eliminate any HTTP endpoints handling user data

bash

# Verify device OS build after update (Apple Configurator / MDM query)
# Expected minimum build: 26.6
mdmctl query --udid <device-udid> --key ProductVersion