CVE-2026-65355

Received Received - Intake

Information Disclosure in Apple iOS and iPadOS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apple Inc.

Description

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-65355

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ios	18.7.10
apple	ipados	18.7.10
apple	ios	26.6.1
apple	ipados	26.6.1
apple	macos_tahoe	26.6.2
apple	visionos	26.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-642	The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure issue where a website may be able to determine a user's IP address even when Private Relay is turned on. Private Relay is designed to hide a user's IP address for privacy, but this flaw allows bypassing that protection.

Detection Guidance

This vulnerability involves information disclosure where a website may detect a user's IP address despite Private Relay being enabled. Detection would require monitoring network traffic for unusual requests or IP address exposure during web browsing sessions. No specific commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could expose your real IP address to websites, reducing your privacy. It may allow tracking of your location or online activity despite using Private Relay. Attackers could exploit this to target you based on your IP.

Mitigation Strategies

Update affected systems to the latest versions: iOS 18.7.10 or later, iPadOS 18.7.10 or later, iOS 26.6.1 or later, iPadOS 26.6.1 or later, macOS Tahoe 26.6.2 or later, and visionOS 26.6.1 or later. This addresses the information disclosure issue by improving state management.

Hi! I’m here to help you understand CVE-2026-65355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70