CVE-2026-64732: Apple iOS and iPadOS · Improper Access Control
Affects Apple iOS and iPadOSSource CVE Database V5
Not known to be exploited · CVSS 4.6 Medium : upgrade to 26.6 or 18.7.10 when convenient.
Data as of 27 Oct 2026, 05:11 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 26.6, 18.7.10, 15.7.7
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade iOS and iPadOS to 26.6 or 18.7.10; macOS to 15.7.7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| AppleiOS and iPadOS | Affected
| Fixed in
|
| AppleiOS and iPadOS | Affected
| Fixed in
|
| ApplemacOS | Affected
| Fixed in
|
AI-suggested
This vulnerability is fixed in iOS 26.6 and iPadOS 26.6. Users and administrators should update affected devices to these versions or later to remediate the issue. No other mitigation or workaround is indicated.
Description
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring.