This vulnerability (CVE-2026-28873) affects Apple iOS and iPadOS and involves an app's ability to bypass the App Privacy Report logging mechanism. The App Privacy Report is designed to log app activities related to privacy-sensitive data access. The issue was resolved by Apple by implementing additional entitlement checks to prevent unauthorized circumvention. The fix is included in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

An app exploiting this vulnerability could avoid being logged in the App Privacy Report, potentially hiding privacy-sensitive activities from users and system monitoring tools. This could reduce transparency and user awareness of app behavior, impacting confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

A fix is available and included in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4. Users and administrators should update affected devices to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.