CVE-2026-84606
Medium
Elevated severity or exploit probability.
CVSS base
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS — probability of exploitation (30 days)
0.3%
23.2th percentile
CISA KEV
Not listed
Weakness / dates
CWE-287
Published 2026-09-14 · modified 2026-09-17
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | N | None |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-09-14 — Published (NVD)
- 2026-09-17 — Last modified (NVD)
Description
A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.