CVE-2026-43723 is a vulnerability in Apple iOS and iPadOS caused by improper path handling, which could allow a malicious app to escalate privileges to root. Apple fixed this issue by improving validation mechanisms. The fix is included in iOS 26.6 and iPadOS 26.6, as well as several other Apple OS versions. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS v3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. No public exploits have been reported.

An attacker who successfully exploits this vulnerability could gain root privileges on affected devices, leading to full control over the system. This includes the ability to read, modify, or delete any data, install malicious software, and disrupt device operations. The vulnerability affects confidentiality, integrity, and availability of the device.

Apple has released official fixes for this vulnerability in iOS 26.6 and iPadOS 26.6. Users and administrators should update their devices to these versions or later to mitigate the risk. Since this is not a cloud service, remediation depends on applying the vendor-provided updates. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.