CVE-2026-65355: Apple iPadOS Information Disclosure Vulnerability

CVE-2026-65355 Overview

CVE-2026-65355 is an information disclosure vulnerability affecting Apple iOS, iPadOS, macOS, and visionOS. The flaw allows a malicious website to determine a user's real IP address even when iCloud Private Relay is enabled. Apple addressed the issue through improved state management in the affected operating systems. The vulnerability is categorized under [CWE-642] (External Control of Critical State Data) and requires user interaction, typically visiting an attacker-controlled webpage.

Critical Impact
Attackers can deanonymize users who rely on iCloud Private Relay for network privacy, exposing the originating IP address to tracking, geolocation, or targeted follow-on attacks.

Affected Products

Apple iOS and iPadOS prior to 18.7.10 and 26.6.1
Apple macOS Tahoe prior to 26.6.2
Apple visionOS prior to 26.6.1

Discovery Timeline

2026-09-14 - CVE-2026-65355 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65355

Vulnerability Analysis

The vulnerability resides in how Apple operating systems manage internal state related to iCloud Private Relay. Private Relay is designed to route Safari traffic through two separate relays so that neither Apple nor the destination website can see both the client IP and the requested content. A state management flaw in the affected components allows a website to observe the user's true IP address despite Private Relay being active. Successful exploitation undermines the privacy guarantees of Private Relay and reveals network-layer identity information. The issue does not affect data integrity or availability, only the confidentiality of the client's network address.

Root Cause

The root cause is improper handling of state data controlling how outbound web requests are routed through the Private Relay proxies. When specific conditions are triggered from a webpage, the system fails to consistently apply the Private Relay egress path. This inconsistency causes requests to bypass the relay and expose the originating IP address. Apple's fix reinforces state management so Private Relay routing is applied deterministically.

Attack Vector

Exploitation is network-based and requires the victim to interact with attacker-controlled content, typically by visiting a crafted website. No credentials or elevated privileges are needed. Once the user loads the malicious page, the site can trigger the flawed code path and record the real IP address returned by the client, correlating it with the user's session. Public exploitation has not been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available for this vulnerability. Refer to the vendor advisories in the mitigation section for technical detail.

Detection Methods for CVE-2026-65355

Indicators of Compromise

Web server logs showing client IP addresses that do not match Apple's published Private Relay egress ranges when connections originate from Safari on affected iOS, iPadOS, macOS, or visionOS versions.
Analytics or fingerprinting data correlating a single user session to multiple IP addresses in rapid succession, one of which matches the user's ISP-assigned address.

Detection Strategies

Compare observed client IP addresses in web application logs against Apple's list of Private Relay egress IP ranges to identify anomalous direct connections from devices that should be relayed.
Monitor endpoint OS version telemetry to identify Apple devices running builds prior to iOS/iPadOS 18.7.10, 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1.
Correlate Safari user-agent traffic with source IP patterns to flag sessions where Private Relay is expected but absent.

Monitoring Recommendations

Track OS patch levels across the Apple device fleet using mobile device management (MDM) inventory reports.
Log and retain HTTP connection metadata, including client IP and TLS fingerprint, to support retrospective analysis if additional Private Relay bypasses are disclosed.
Alert on Apple devices communicating with untrusted or newly registered domains, which are common staging points for deanonymization attempts.

How to Mitigate CVE-2026-65355

Immediate Actions Required

Update all Apple devices to iOS 18.7.10, iPadOS 18.7.10, iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1 as applicable.
Enforce minimum OS version compliance policies through MDM to block or quarantine devices that remain on vulnerable builds.
Communicate to privacy-sensitive users that Private Relay guarantees are weakened until patches are installed.

Patch Information

Apple released fixes across the affected platforms with improved state management. See the vendor advisories: Apple Support Article #148281, Apple Support Article #148282, Apple Support Article #148287, and Apple Support Article #148353.

Workarounds

Disable iCloud Private Relay temporarily and route traffic through an audited VPN if patching cannot be completed immediately and IP-address privacy is critical.
Restrict Safari browsing on unpatched devices to trusted sites to reduce exposure to malicious deanonymization pages.
Apply network egress controls that limit direct outbound web traffic from managed Apple devices until updates are deployed.

bash

# Verify installed macOS version meets the patched build
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -ia --restart