CVE-2026-28873
App may bypass App Privacy Report logging in iOS and iPadOS
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: Apple Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apple | ios | to 18.7.9 (inc) |
| apple | ipad_os | to 18.7.9 (inc) |
| apple | ios | to 26.4 (inc) |
| apple | ipad_os | to 26.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves an issue where an app may be able to bypass the App Privacy Report logging due to insufficient entitlement checks.
The problem was addressed by adding additional entitlement checks to prevent apps from circumventing the logging mechanism.
It affects iOS and iPadOS versions prior to 18.7.9 and 26.4, respectively.
How can this vulnerability impact me? :
An app exploiting this vulnerability could avoid being logged in the App Privacy Report, potentially hiding its activities from users.
This could lead to reduced visibility into app behavior and privacy practices, making it harder for users to detect unauthorized or malicious actions.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your devices to iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, or iPadOS 26.4 where the issue has been fixed with additional entitlement checks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an app to potentially circumvent App Privacy Report logging, which may impact the ability to fully monitor and audit app behavior related to user data.
Since App Privacy Report logging is a tool that helps track app access to sensitive data, its circumvention could hinder compliance efforts with privacy regulations such as GDPR and HIPAA that require transparency and accountability in data handling.
However, the specific impact on compliance with these standards is not detailed in the provided information.