CVE-2026-65406

CVE-2026-65406 is a logic flaw caused by insufficient validation in Apple's operating systems, addressed with improved checks in a record-setting wave of Apple patches. An app installed on an affected device may be able to access sensitive user data beyond what its permissions should allow, meaning exploitation requires the victim to first install a malicious or compromised app (e.g., via App Store, sideloading, or enterprise distribution) rather than a remote network vector. Successful abuse gives the attacker's app unauthorized access to sensitive user data, a privacy/confidentiality breach rather than code execution. Affected users are those running iOS and iPadOS prior to the fixes in 26.7 and 27, macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate prior to 27, tvOS prior to 27, and visionOS prior to 27. There is no known in-the-wild exploitation, no public PoC, and the CVE is not on CISA's KEV list, though CVSS has not yet been scored and details may evolve.

What to do: Patch promptly: update iPhones and iPads to iOS/iPadOS 26.7 or 27, Macs to macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, Apple TVs to tvOS 27, and Vision Pro headsets to visionOS 27, with MDM/IT fleets pushing these updates organization-wide. Because exploitation requires a malicious app on the device, audit installed apps, remove unfamiliar or unnecessary ones, and review app permission grants for suspicious data access. Watch for follow-up Apple advisories or a CVSS score, since this flaw landed in a record-setting patch wave and severity details may still be refined.