CVE-2026-64746: Apple iPadOS Auth Bypass Vulnerability

CVE-2026-64746 Overview

CVE-2026-64746 is an authorization bypass vulnerability affecting multiple Apple operating systems. The flaw allows an application to add entries to the user's Contacts database without obtaining explicit user authorization. Apple addressed the issue through improved validation in the affected subsystem. The vulnerability is tracked under CWE-862: Missing Authorization.

Apple released fixes across its operating system portfolio, including iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
A malicious or over-privileged app can silently write to the user's Contacts store, undermining a core iOS/macOS privacy consent boundary and enabling data planting or persistence.

Affected Products

Apple iOS and iPadOS (prior to 26.6)
Apple macOS Tahoe (prior to 26.6)
Apple visionOS and watchOS (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-64746 published to the National Vulnerability Database
2026-07-28 - Entry last modified in the NVD database

Technical Details for CVE-2026-64746

Vulnerability Analysis

The vulnerability is a missing authorization check (CWE-862) in the Contacts access path across Apple's operating systems. Applications on iOS, iPadOS, macOS, visionOS, and watchOS must normally request user consent through the TCC (Transparency, Consent, and Control) framework before reading or writing Contacts entries. The affected code path did not correctly validate this authorization state before permitting write operations.

As a result, an app installed on a vulnerable device could add new contacts to the user's address book without displaying the standard consent prompt or being granted the Contacts entitlement. Apple's advisories describe the resolution as an authorization issue addressed with improved validation, indicating the fix reinstates the required entitlement check in the write path.

While the immediate primitive is limited to adding contact records, the impact extends beyond nuisance. Injected contacts can be leveraged for social engineering, caller-ID spoofing when combined with contact-based trust cues, and as a persistence or staging mechanism synced through iCloud to other devices tied to the same Apple ID.

Root Cause

The root cause is a missing or incomplete authorization check in the Contacts subsystem. The affected API did not enforce that the calling process held the required Contacts privacy entitlement before mutating the address book.

Attack Vector

Exploitation requires a locally installed application on an affected device. Any app, including those distributed through the App Store that never requested Contacts access, could invoke the vulnerable path to insert arbitrary contact entries. No user interaction beyond installing and running the app is required. See the Apple Security Advisory #128066 and Apple Security Advisory #128070 for platform-specific details.

Detection Methods for CVE-2026-64746

Indicators of Compromise

Unexpected new entries appearing in the Contacts application that the user did not create or import.
Contacts entries synchronized through iCloud to secondary devices without a corresponding user action.
Third-party applications running on unpatched OS builds (versions prior to 26.6) that have never prompted for Contacts access but interact with AddressBook or Contacts framework APIs.

Detection Strategies

Inventory managed Apple devices and flag OS builds earlier than iOS/iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6.
Review MDM privacy reports (App Privacy Report on iOS) for applications accessing Contacts without a corresponding user-granted entitlement.
On macOS, audit the TCC.db privacy database for applications that wrote to Contacts without a kTCCServiceAddressBook grant.

Monitoring Recommendations

Enable and collect App Privacy Report telemetry from managed iOS/iPadOS devices where available.
Forward macOS Endpoint Security events related to Contacts database access to a centralized log platform for correlation.
Alert on installation of unsigned or side-loaded applications on devices that remain on pre-26.6 builds.

How to Mitigate CVE-2026-64746

Immediate Actions Required

Deploy the vendor updates to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6 across all managed Apple endpoints.
Use MDM update enforcement to require the fixed OS versions and defer app installations on devices that cannot be updated.
Audit installed applications for unnecessary Contacts access and remove apps that are not required for business use.

Patch Information

Apple published fixes in the 26.6 release train. Consult Apple Security Advisory #128066, Advisory #128067, Advisory #128068, and Advisory #128070 for the platform-specific update packages and validation guidance.

Workarounds

No official workaround exists; applying the vendor patch is the only supported remediation.
As a compensating control, restrict app installation to vetted sources via MDM allowlists until updates are deployed.
Periodically export and review the Contacts store on high-risk accounts to detect unauthorized additions.

bash

# Verify current OS build on macOS and confirm the fix is installed
sw_vers
# Expected ProductVersion: 26.6 (macOS Tahoe) or later

# Verify iOS/iPadOS build via MDM query (example: Jamf Pro)
# jamf policy -event inventory && jamf recon
# Then filter devices where OS Version < 26.6