Authorization Flaw in Apple Devices Allowing Unauthorized Contact Additions
CVE-2026-64746

9.8CRITICAL

Key Information:

Vendor

Apple
Status
iOS And iPad OS
Mac OS
Visionos
Watch OS
Vendor
CVE Published:
27 July 2026

What is CVE-2026-64746?

An authorization vulnerability exists in certain Apple operating systems, allowing apps to potentially add contacts without the user's explicit consent. This flaw has been addressed in the latest updates for iOS, iPadOS, macOS, visionOS, and watchOS, wherein improved validation mechanisms have been implemented to enhance user security and prevent unauthorized contact manipulation.

Affected Version(s)

iOS and iPadOS 0 < 18.7.10

iOS and iPadOS 0 < 26.6

macOS 0 < 26.6

References

https://support.apple.com/en-us/128066
https://support.apple.com/en-us/128067
https://support.apple.com/en-us/128068

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.