This vulnerability (CVE-2026-20606) in Apple iOS and iPadOS allows an application to bypass certain privacy preferences, potentially exposing sensitive user data. The issue was resolved by Apple by removing the vulnerable code. The fix is included in iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3, and macOS Sequoia 15.7.4, Sonoma 14.8.4, and Tahoe 26.3. The CVSS 3.1 base score is 7.1, reflecting a local attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality and integrity impact. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability could allow a malicious app to bypass user-configured privacy preferences, leading to unauthorized access to sensitive data on affected Apple devices. The impact affects confidentiality and integrity but does not affect system availability. No active exploitation has been reported.

Apple has released official fixes for this vulnerability in iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3, and corresponding macOS versions. Users and administrators should apply these updates promptly to remediate the issue. Since this is not a cloud service vulnerability, patching the affected devices is required to mitigate the risk. Patch status is confirmed by the vendor advisory stating the issue was fixed by removing the vulnerable code.