High severity7.5NVD Advisory· Published May 11, 2026· Updated Jun 17, 2026

CVE-2026-28873

Description

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. An app may be able to circumvent App Privacy Report logging.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apple Inc./Ipados2 versions
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*range: <18.7.9
- (no CPE)range: iPadOS 18.7.9, iPadOS 26.4
Apple Inc./Iphone OS
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Range: <18.7.9
Apple Inc./iOSllm-fuzzy
Range: iOS 18.7.9, iOS 26.4

Patches

Vulnerability mechanics

References

support.apple.com/en-us/126792nvdRelease NotesVendor Advisory
support.apple.com/en-us/127111nvdRelease NotesVendor Advisory

News mentions

Apple Patches Everything, (Mon, May 11th)
SANS Internet Storm Center · May 11, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000