Apple has identified a privacy vulnerability that may allow an application to fingerprint a user by collecting identifiable data that can be tied to a particular device or identity. The flaw is resolved through improved data protection measures incorporated into the next OS releases. No mention is made of data exfiltration or system compromise, but the potential to uniquely identify individuals raises significant privacy concerns for users and administrators.

Vendors impacted are Apple for all major operating systems: iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The fix is delivered in version 26.6 for each platform (iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6). Devices running earlier releases may be susceptible to fingerprinting by malicious or mishandled applications.

The EPSS score is < 1%, indicating a very low but non-zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently a known widespread exploit. The CVSS score of 9.8 indicates high severity, but the risk level is principally privacy-oriented rather than a direct attack vector such as remote code execution. An attacker would need to install or persuade a user to install an app that can gather identifying information; the vulnerability is best viewed as an attack vector that enables device fingerprinting if the app actively requests or collects the sensitive data. Because no exploit codes are publicly documented, the practical exploitation likelihood appears limited, yet the privacy impact remains.