Description
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps.
Published: 2026-03-25
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Update Now
AI Analysis

Impact

A permissions flaw lets an installed application discover which other applications are present on the device, exposing a list of user‑installed software. This disclosure can reveal user habits or installed services but does not compromise integrity or availability of the operating system.

Affected Systems

Apple’s iOS, iPadOS, macOS, and visionOS are affected. The flaw is resolved in iOS 18.7.7 and iOS 26.4, iPadOS 18.7.7 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, and visionOS 26.4. Versions older than these remain vulnerable unless updated.

Risk and Exploitability

The CVSS base score of 6.5 indicates moderate severity, and an EPSS score below 1 % suggests exploitation is unlikely under current conditions. The vulnerability isn’t listed in CISA’s KEV catalog. It can only be exploited by an application that has been installed on the device—so the attack vector is local, depending on user‑initiated installation of malicious software. No remote or privilege escalation mechanisms are described in the available data.

Generated by OpenCVE AI on March 26, 2026 at 14:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade iOS to 18.7.7 or later, or to 26.4 or later, and iPadOS to the corresponding versions.
  • Update macOS to Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 and higher.
  • Upgrade visionOS to 26.4 or later.
  • Verify that updated OS versions are active on all affected devices.
  • Maintain cautious app installation practices by using verified app sources.

Generated by OpenCVE AI on March 26, 2026 at 14:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 27 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
Title Apple OS Permissions Issue Allowing Application Enumeration

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title App Enumeration via Permissions Issue
Weaknesses CWE-200

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title App Enumeration via Permissions Issue
Weaknesses CWE-200

Wed, 25 Mar 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 25 Mar 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple visionos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple visionos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Visionos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:17:40.567Z

Reserved: 2026-03-03T16:36:03.974Z

Link: CVE-2026-28880

cve-icon Vulnrichment

Updated: 2026-03-25T20:15:17.936Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:11.853

Modified: 2026-03-25T21:29:50.140

Link: CVE-2026-28880

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:53:43Z

Weaknesses