CVE-2026-65345: Apple iPadOS Information Disclosure Flaw

CVE-2026-65345 Overview

CVE-2026-65345 is a permissions vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw allows a local application to access user-sensitive data that should be restricted by the operating system's access control model. Apple addressed the issue by applying additional restrictions to the affected component. The weakness is categorized as Improper Access Control [CWE-284].

Exploitation requires local access and user interaction, limiting remote attack scenarios. However, any installed application on an affected device could leverage the flaw to read protected user information.

Critical Impact
An application running on an unpatched Apple device may read user-sensitive data outside its permitted scope, resulting in confidentiality loss on iPhone, iPad, and Mac systems.

Affected Products

Apple iOS (fixed in iOS 26.7 and iOS 27)
Apple iPadOS (fixed in iPadOS 26.7 and iPadOS 27)
Apple macOS (fixed in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27)

Discovery Timeline

2026-09-14 - CVE-2026-65345 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-65345

Vulnerability Analysis

CVE-2026-65345 stems from an improper access control condition in Apple's operating systems. The affected component did not enforce sufficient permission checks before granting access to protected user data. As a result, a local application could reach data that the platform's sandbox and privacy controls are designed to isolate.

Apple's advisory states the issue was resolved with additional restrictions, indicating the fix tightens the permission model rather than introducing a new mechanism. The bug is confidentiality-only; it does not enable modification of data or disruption of service. Because attack complexity is low and no privileges are required, a malicious or compromised app on the device can trigger the condition once the required user interaction occurs.

Root Cause

The root cause is an inadequate permission boundary in an Apple platform component, mapping to Improper Access Control [CWE-284]. The vulnerable code path allowed callers to reach sensitive user data without validating that the requesting context held the required entitlements or user consent. Apple's remediation adds explicit restrictions on this access path.

Attack Vector

The attack vector is local. An attacker must deliver a crafted or repurposed application to the target device through the App Store, sideloading, enterprise distribution, or an already-installed app that has been compromised. The application then invokes the affected interface and, after the required user interaction, retrieves user-sensitive data such as content typically gated by Apple's privacy consent prompts.

Apple has not published exploitation details. No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities Catalog listing is available for this CVE. Refer to the Apple Support Article #149034 for vendor-provided technical context.

Detection Methods for CVE-2026-65345

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-65345 at this time.
Absence of the required OS build (iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27) on managed Apple devices.
Applications requesting or accessing privacy-scoped data outside their declared entitlements.

Detection Strategies

Inventory Apple endpoints through mobile device management (MDM) and flag devices below the patched OS build numbers.
Review installed applications for unexpected access to Contacts, Photos, Location, Calendars, or other privacy-scoped data classes.
Correlate application install events with subsequent access to user data services on macOS using unified log entries from tccd and related privacy subsystems.

Monitoring Recommendations

Monitor macOS Transparency, Consent, and Control (TCC) database changes and unexpected consent prompt bypasses.
Track application version and entitlement changes across the fleet to detect apps that suddenly attempt to access new sensitive data categories.
Ingest MDM compliance telemetry into your SIEM or data lake to alert on Apple devices that fail to receive the fixed OS build within the defined patch SLA.

How to Mitigate CVE-2026-65345

Immediate Actions Required

Update iPhone and iPad devices to iOS 26.7, iPadOS 26.7, iOS 27, or iPadOS 27.
Update Mac devices to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27.
Enforce the minimum required OS build through MDM compliance policies and block non-compliant devices from corporate resources.
Audit installed third-party applications and remove any that are unnecessary or untrusted.

Patch Information

Apple released fixes across five advisories covering the affected operating systems. Consult the vendor advisories for full build numbers and download instructions: Apple Support Article #149034, Apple Support Article #149035, Apple Support Article #149041, Apple Support Article #149042, and Apple Support Article #149043.

Workarounds

No vendor-provided workaround exists; applying the OS update is the supported remediation.
Restrict app installation to vetted sources and require App Store or MDM-approved distribution.
Review and revoke unnecessary privacy permissions (Contacts, Photos, Location, Full Disk Access) granted to installed applications until patching is complete.

bash

# Verify patched build on macOS
sw_vers

# Example MDM compliance query (jamf) for iOS build
# Ensure devices report iOS/iPadOS 26.7 or later
# Devices below the required build should be flagged non-compliant