CVE-2026-28906 - This issue was addressed through improved state management

Back Back to CVE browser

HIGH

This issue was addressed through improved state management

Published May 11, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.50%

Description

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, visionOS 26.5. An attacker may be able to track users through their IP address.

Affected products

Vendor Apple Product iOS and iPadOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <18.7.9
- Version
  0
  Status
  affected
  Constraints
  <26.5
Vendor Apple Product macOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <14.8.7
- Version
  0
  Status
  affected
  Constraints
  <15.7.7
- Version
  0
  Status
  affected
  Constraints
  <26.5
Vendor Apple Product visionOS Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <26.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apple

iOS and iPadOS

n/a

Version	Status	Constraints
0	affected	<18.7.9
0	affected	<26.5

Apple

macOS

n/a

Version	Status	Constraints
0	affected	<14.8.7
0	affected	<15.7.7
0	affected	<26.5

Apple

visionOS

n/a

Version	Status	Constraints
0	affected	<26.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-359

References (6)

https://support.apple.com/en-us/127110
Release NotesVendor Advisory
https://support.apple.com/en-us/127111
Release NotesVendor Advisory
https://support.apple.com/en-us/127115
Release NotesVendor Advisory
https://support.apple.com/en-us/127116
Release NotesVendor Advisory
https://support.apple.com/en-us/127117
Release NotesVendor Advisory
https://support.apple.com/en-us/127120
Release NotesVendor Advisory

Link	Providers	Tags
https://support.apple.com/en-us/127110		Release NotesVendor Advisory
https://support.apple.com/en-us/127111		Release NotesVendor Advisory
https://support.apple.com/en-us/127115		Release NotesVendor Advisory
https://support.apple.com/en-us/127116		Release NotesVendor Advisory
https://support.apple.com/en-us/127117		Release NotesVendor Advisory
https://support.apple.com/en-us/127120		Release NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apple

Published May 11, 2026

Updated May 12, 2026

Reserved Mar 3, 2026

Link CVE-2026-28906

CISA Vulnrichment

Updated May 12, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-28906

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-28906