Technical impact
The vulnerability is a logic error that was addressed with improved error handling. It causes iCloud Private Relay not to activate when more than one user logs in at the same time. The flaw is identified as a CWE-843 type inconsistency. The impact is that the privacy protection normally provided by Private Relay could be bypassed, leaving traffic unfiltered and potentially exposed, effectively a denial of privacy.
Affected Systems
Affected systems include Apple macOS operating systems, specifically those versions prior to macOS Tahoe 26.1, where the iCloud Private Relay feature is present. Users who enable multiple logins on a single machine may experience the failure to activate Private Relay until the system is updated.
Risk and Exploitability
The CVSS score of 7.5 reflects a high severity, while the EPSS score of less than 1%% indicates a very low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. Attackers would need to create a scenario where multiple users are logged in concurrently, which limits the attack surface largely to local or privileged users rather than remote attackers.
