This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple
  • Ios And Ipados
  • Ipados
  • Iphone Os
  • Tvos
  • Visionos
  • Watchos

Configuration 1 [-]

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://support.apple.com/en-us/149034 cve-icon cve-icon
https://support.apple.com/en-us/149036 cve-icon cve-icon
https://support.apple.com/en-us/149037 cve-icon cve-icon
https://support.apple.com/en-us/149038 cve-icon cve-icon
History

Sun, 20 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title App Entitlement Check Failure Allows User Fingerprinting

Wed, 16 Sep 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 16 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Title Application Entitlement Bypass Allows User Fingerprinting
Weaknesses CWE-200

Tue, 15 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title Application Entitlement Bypass Allows User Fingerprinting
Weaknesses CWE-200

Tue, 15 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple tvos
Apple visionos
Apple watchos

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-09-14T20:47:47.004Z

Updated: 2026-09-16T12:50:55.131Z

Reserved: 2026-09-01T21:13:23.287Z

Link: CVE-2026-84629

cve-icon Vulnrichment

Updated: 2026-09-16T12:50:30.659Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:37.840

Modified: 2026-09-16T18:25:41.563

Link: CVE-2026-84629

cve-icon Redhat

No data.