CVE-2026-64755: Apple iPadOS Information Disclosure Flaw

CVE-2026-64755 Overview

CVE-2026-64755 is an authorization vulnerability affecting Apple iOS and iPadOS. The flaw allows a local application to access sensitive user data due to improper state management within the authorization logic. Apple addressed the issue through improved state management in iOS 26.6 and iPadOS 26.6.

The vulnerability is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires local access and user interaction, limiting the attack surface to apps already installed on the device.

Critical Impact
A malicious or compromised app installed on an iOS or iPadOS device may bypass authorization controls to read sensitive user data without appropriate consent.

Affected Products

Apple iOS versions prior to 26.6
Apple iPadOS versions prior to 26.6
Devices running vulnerable Apple mobile operating system builds

Discovery Timeline

2026-07-27 - CVE-2026-64755 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64755

Vulnerability Analysis

The vulnerability resides in an authorization component of iOS and iPadOS where state management failed to consistently enforce access checks. An application on the device can leverage this weakness to obtain sensitive user data that authorization policies should protect.

Apple describes the fix as improved state management, indicating the underlying issue involved inconsistent or incomplete tracking of authorization state during multi-step operations. This class of flaw typically arises when a component caches or transitions authorization decisions without revalidating them against the current user or system context.

The EPSS probability score is 0.121%, reflecting a low current expectation of active exploitation. No public proof-of-concept code, exploit tooling, or CISA KEV listing is associated with this identifier.

Root Cause

The root cause is improper authorization state management within an unspecified iOS/iPadOS subsystem. The affected code path did not maintain consistent authorization checks, allowing an app to reach a state in which access to protected data was granted without the required policy enforcement.

Attack Vector

Exploitation requires a locally installed application and user interaction on the target device. Remote or network-based exploitation is not possible. An attacker must deliver a malicious app or compromise a legitimate app to reach the vulnerable code path.

No verified public exploitation code is available. Refer to the Apple Support Article for the vendor's technical description.

Detection Methods for CVE-2026-64755

Indicators of Compromise

Applications requesting or handling sensitive user data outside of documented entitlements.
Unexpected access patterns to Photos, Contacts, Location, Health, or other protected data classes by third-party apps.
Devices reporting an OS build older than iOS 26.6 or iPadOS 26.6 in mobile device management (MDM) inventories.

Detection Strategies

Query MDM and unified endpoint management systems for devices running iOS or iPadOS builds prior to 26.6.
Review App Store distribution and enterprise app deployments for apps that request broad or unusual data-access entitlements.
Correlate privacy-related system logs on managed devices to identify anomalous access to sensitive data classes.

Monitoring Recommendations

Track Apple security advisories and pair CVE metadata with device inventory to flag non-compliant assets.
Monitor user reports of unexpected privacy prompts or data access notifications on iOS and iPadOS devices.
Alert on newly installed applications that request sensitive entitlements outside of an approved application catalog.

How to Mitigate CVE-2026-64755

Immediate Actions Required

Update all iPhone and iPad devices to iOS 26.6 or iPadOS 26.6 or later.
Enforce OS update compliance policies through MDM to prevent devices from remaining on vulnerable builds.
Restrict installation of untrusted third-party applications, especially those requesting sensitive data entitlements.

Patch Information

Apple resolved CVE-2026-64755 in iOS 26.6 and iPadOS 26.6 with improved state management in the affected authorization component. Users and administrators should apply the update through Settings > General > Software Update or via MDM update commands. The vendor advisory is available at the Apple Support Article.

Workarounds

No official workaround is published by Apple; applying the iOS 26.6 or iPadOS 26.6 update is the supported remediation.
Limit installation of apps to those from vetted developers and the official App Store until devices are patched.
Review and revoke unnecessary privacy permissions granted to installed applications on unpatched devices.

bash

# Example MDM query to identify vulnerable iOS/iPadOS devices
# (pseudo-command; adapt to your MDM's query syntax)
mdm-cli devices list \
  --filter "os_name in ('iOS','iPadOS') and os_version < '26.6'" \
  --fields device_id,user,os_name,os_version,last_checkin