CVE-2026-65353: Apple iPadOS Auth Bypass Vulnerability

CVE-2026-65353 Overview

CVE-2026-65353 is an authorization vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw allows a local application to access sensitive user data by exploiting improper state management in the affected operating systems. Apple addressed the issue with improved state management in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. The vulnerability maps to [CWE-285: Improper Authorization] and requires local access with low privileges, without user interaction.

Critical Impact
A malicious app installed on an affected device can bypass authorization checks and read sensitive user data outside its permitted scope.

Affected Products

Apple iOS (versions prior to 26.6)
Apple iPadOS (versions prior to 26.6)
Apple macOS Tahoe (versions prior to 26.6)

Discovery Timeline

2026-09-14 - CVE-2026-65353 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65353

Vulnerability Analysis

The vulnerability originates in an authorization component within Apple's mobile and desktop operating systems. State transitions during authorization checks are not tracked correctly, permitting an app to reach a state where sensitive data becomes accessible without proper entitlements. Apple's advisory describes the fix as improved state management, indicating the enforcement logic was inconsistent across code paths.

Exploitation requires code execution on the device, meaning an attacker must first deliver a malicious app or leverage an existing app running on the target system. Because the vulnerability targets confidentiality only, it does not modify data or crash the system. However, exposed data may include information protected by user permission prompts such as contacts, photos, location history, or app-specific privacy scopes.

Root Cause

The root cause is improper authorization enforcement tied to inconsistent state management ([CWE-285]). A component that grants or denies access to protected user data fails to maintain a consistent authorization state across operations. An app can therefore reach a code path where an authorization decision reflects stale or incorrect state, granting access that policy would otherwise deny.

Attack Vector

The attack vector is local. An attacker crafts an app that invokes the vulnerable API sequence to manipulate authorization state, then requests protected user data. No user interaction is required beyond initial installation, and only low privileges are needed. Apple has not disclosed the specific subsystem or API involved. Refer to Apple Support Article #128066 and Apple Support Article #128067 for vendor-provided details.

Detection Methods for CVE-2026-65353

Indicators of Compromise

Applications requesting access to Transparency, Consent, and Control (TCC)-protected resources outside their declared entitlements
Unexpected reads of contacts, photos, location, or clipboard data by apps that do not require them
Apps invoking private or undocumented APIs shortly after launch

Detection Strategies

Audit installed applications on managed iOS, iPadOS, and macOS fleets against approved baselines
Enable Endpoint Security framework logging on macOS to capture privacy-scope access events
Correlate app installation events with subsequent access attempts to sensitive data stores

Monitoring Recommendations

Track OS build versions across the fleet and flag devices running versions earlier than 26.6
Monitor App Store and enterprise MDM distribution channels for newly sideloaded or unsigned apps
Alert on repeated authorization failures followed by successful sensitive data access within short time windows

How to Mitigate CVE-2026-65353

Immediate Actions Required

Deploy iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6 to all affected devices through Mobile Device Management (MDM) or manual update
Inventory devices that remain on pre-26.6 builds and prioritize them for patching
Review installed third-party applications and remove any without a clear business justification

Patch Information

Apple released fixes in iOS 26.6, iPadOS 26.6, and macOS Tahoe 26.6. Patch details are documented in Apple Support Article #128066 and Apple Support Article #128067. Apply the vendor updates as the primary remediation.

Workarounds

Restrict app installations to vetted sources through MDM configuration profiles
Reduce privacy scope grants for non-essential apps until updates are deployed
Enforce Lockdown Mode on high-risk user devices where feasible

bash

# Verify device OS version meets patched baseline
# macOS
sw_vers -productVersion

# iOS/iPadOS via MDM query (example: Jamf)
# jamf policy -event checkOSVersion