An application may send or receive user data over the network without enforcing HTTPS, enabling an attacker to intercept the traffic and expose sensitive information. This is a cleartext transmission of sensitive data (CWE‑319). The vulnerability does not provide code execution or denial of service, but it can lead to privacy violations if the data is captured.

Apple iOS, iPadOS, tvOS, visionOS, and watchOS versions prior to 26.6 are affected. All devices running these operating systems that are older than the 26.6 release are at risk until the user updates to the patched version.

An attacker can exploit the lack of encryption by positioning themselves between the device and the intended recipient using a malicious Wi‑Fi access point or compromised router. The EPSS score of <1% indicates a low overall probability of exploitation in the wild, but the absence of encryption makes the attack straightforward for a network adversary. The CVSS score of 6.5 indicates a medium severity level. The vulnerability is not listed in the CISA KEV catalog, and the impact is the disclosure of confidential user data.