Security readout for executives and security teams
Plain-English summary
Apple fixed a flaw across its operating systems where an app could collect device characteristics in a way that uniquely identifies the user. This kind of "fingerprinting" lets apps or advertisers track people across services without consent. Apple addressed it by tightening permissions in iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. Users should install the updates.
Executive priority
Medium priority. This is a privacy hardening fix, not a remote code execution issue, and there is no evidence of active exploitation. Roll it into the standard Apple update cycle for managed fleets, with particular attention to executive devices and any roles where tracking by third-party apps would create regulatory or reputational concern.
Technical view
CVE-2026-28863 is a permissions issue (CWE-284, Improper Access Control) in multiple Apple operating systems that allowed an installed application to fingerprint the user. Apple resolved the issue by adding additional restrictions in iOS/iPadOS 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4. CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), reflecting confidentiality impact with required user interaction.
Likely exposure
Any Apple device running a pre-26.4 release of iOS, iPadOS, tvOS, visionOS, or watchOS with third-party apps installed is potentially exposed. Specific affected version ranges are not enumerated in the public advisory beyond "fixed in 26.4," so older supported releases should be assumed vulnerable until verified against Apple's security notes.
Exploitation context
No public reports of active exploitation and the CVE is not on CISA's KEV list. Exploitation requires a malicious or privacy-abusive app to be installed and run by the user (UI:R). Impact is limited to privacy (user tracking/fingerprinting), not code execution or data tampering. No exploit code is referenced in Apple's advisories.
Researcher notes
Apple's advisory text is intentionally terse: "permissions issue was addressed with additional restrictions" and "an app may be able to fingerprint the user." The CVSS vector (AV:N/PR:N/UI:R/C:H/I:N/A:N) is consistent with a confidentiality-only flaw triggered by user-installed app behavior. CWE-284 mapping fits the description. No specific affected component, API, or pre-fix version range is disclosed; the only authoritative versioning anchor is "fixed in 26.4." Treat further attribution to a particular subsystem as speculation absent an Apple update to the advisory.
Mitigation direction
- Update affected devices to iOS 26.4, iPadOS 26.4, tvOS 26.4, visionOS 26.4, or watchOS 26.4 or later.
- Enforce minimum OS versions via MDM and block enrollment of out-of-date devices.
- Review installed third-party apps and remove any unnecessary or untrusted applications.
- Consult Apple's security advisories (HT126792/126797/126798/126799) for vendor-supplied guidance.
- Reinforce app-vetting policy for corporate-managed devices to limit privacy-abusive apps.
Validation and detection
- Inventory Apple devices and confirm OS build is at or above the 26.4 release for each platform.
- Use MDM compliance reporting to flag devices still on pre-26.4 builds.
- Spot-check Settings > General > About on a sample of devices to confirm the patched version.
- Cross-reference Apple's advisory pages for CVE-2026-28863 to confirm the fix is included in installed builds.
- Track remediation progress in vulnerability management until fleet coverage is complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28863 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N2.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/126792CVE reference, apple
- https://support.apple.com/en-us/126797CVE reference, apple
- https://support.apple.com/en-us/126798CVE reference, apple
- https://support.apple.com/en-us/126799CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.