CVE-2026-43695

CVE-2026-43695 is an authorization issue caused by improper state management in Apple's operating systems, fixed across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS in the September 2026 updates. A malicious or poorly behaved app running on an unpatched device could exploit inconsistent permission state to access sensitive user data beyond what it was authorized to see. Exploitation requires a victim to run the attacker's app on an affected iPhone, iPad, Mac, Apple TV, Apple Watch, or Vision Pro; no user interaction with a remote attacker is implied. All users on versions prior to the fixed releases listed in Apple's advisory are affected. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Patch all Apple devices to the fixed releases: iOS/iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Enterprise admins should push these updates via MDM and prioritize them since the flaw allows apps to read sensitive user data. Users and defenders should also audit installed apps and review app permissions under Settings > Privacy & Security to remove any untrusted apps with broad data access.