Apple iOS/iPadOS Auth Bypass via State Management (18.7.10)
CVE-2026-65404 Published on September 14, 2026
An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A malicious application may be able to bypass Privacy preferences.
Vulnerability Analysis
CVE-2026-65404 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-65404 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-65404
Want to know whenever a new CVE is published for Apple products? stack.watch will email you.
Affected Versions
Apple iOS and iPadOS:- Before 18.7.10 is affected.
- Before 27 is affected.
- Before 14.8.8 is affected.
- Before 15.7.8 is affected.
- Before 27 is affected.