Apple iOS Identifier Privacy Leak Across Reinstalls
CVE-2026-84606 Published on September 14, 2026
A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.
Vulnerability Analysis
CVE-2026-84606 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Types
Use of Insufficiently Random Values
The software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.
What is a Privacy violation Vulnerability?
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CVE-2026-84606 has been classified to as a Privacy violation vulnerability or weakness.
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-84606 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2026-84606
Want to know whenever a new CVE is published for Apple products? stack.watch will email you.
Affected Versions
Apple iOS and iPadOS:- Before 27 is affected.
- Before 27 is affected.
- Before 27 is affected.