Security readout for executives and security teams
Plain-English summary
A flaw in Apple operating systems could let an app add contacts without the user’s permission. This undermines privacy and may allow unauthorized modification of address-book data. Apple states that improved validation fixes the issue in specified iOS, iPadOS, macOS, visionOS, and watchOS releases.
Executive priority
Prioritize accelerated patching of managed Apple fleets, especially devices handling sensitive contact data. The critical rating supports urgency, but the public description is narrower than the supplied CVSS impact claims. Track completion centrally and escalate devices unable to receive the listed fixed releases.
Technical view
CVE-2026-64746 is an authorization weakness classified as CWE-862. The supplied record assigns CVSS 3.1 score 9.8, but the described impact is limited to unauthorized contact creation. The bundle does not explain the vulnerable component, attack prerequisites, affected version ranges, or evidence supporting the CVSS confidentiality, integrity, and availability impacts.
Likely exposure
Potential exposure includes Apple devices running versions older than the listed fixed releases. However, the source bundle provides unusable affected-version entries and does not establish precise vulnerable ranges. Inventory iOS, iPadOS, macOS, visionOS, and watchOS versions, then compare them with Apple’s platform-specific advisories.
Exploitation context
The bundle provides no evidence of active exploitation, public proof-of-concept code, or weaponization. The CVE is not identified as being in CISA KEV. Although the supplied vector describes remote, unauthenticated exploitation without user interaction, the narrative describes an app performing the unauthorized action; this discrepancy requires vendor clarification.
Researcher notes
Public technical detail is limited. The record identifies missing authorization and improved validation but provides no component name, root cause, affected-version boundaries, or exploitation evidence. Researchers should avoid treating the CVSS vector as proof of practical network reachability or full system compromise without corroborating Apple documentation.
Mitigation direction
- Update iPhones and iPads to iOS or iPadOS 18.7.10 or 26.6, as applicable.
- Update Macs to macOS Tahoe 26.6.
- Update Apple Vision Pro devices to visionOS 26.6.
- Update Apple Watches to watchOS 26.6.
- Review Apple advisories for supported devices and any platform-specific instructions.
Validation and detection
- Inventory operating-system versions across all managed Apple devices.
- Confirm installed versions meet the applicable fixed release stated by Apple.
- Check device-management reports for failed, deferred, or blocked updates.
- Review Apple advisories to determine applicability where version branches are unclear.
- Monitor endpoint telemetry for unexpected contact creation by applications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-64746 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/128066CVE reference, apple
- https://support.apple.com/en-us/128067CVE reference, apple
- https://support.apple.com/en-us/128068CVE reference, apple
- https://support.apple.com/en-us/128070CVE reference, apple
- https://support.apple.com/en-us/148287CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.