An application may send or receive user data over the network without using HTTPS, which allows an attacker to intercept that traffic and gain access to confidential information. The vulnerability is a cleartext transmission of sensitive data and corresponds to CWE‑319 (Cleartext Transmission). It does not provide code execution or denial of service, but it can lead to privacy violations if the data is intercepted.

Apple iOS, iPadOS, tvOS, visionOS, and watchOS versions prior to 26.6 are affected. All devices running these operating systems that are older than the 26.6 release are at risk until the user updates to the patched version.

An attacker can exploit the lack of encryption by positioning themselves between the device and the intended recipient using a malicious Wi‑Fi access point or compromised router. The EPSS score of <1% indicates a low overall probability of exploitation in the wild, but the absence of encryption makes the attack straightforward for a network adversary. The CVSS score of 6.5 indicates a medium severity level. The vulnerability is not listed in the CISA KEV catalog, and the impact is the disclosure of confidential user data.