CVE-2026-64746
A security flaw in Apple's operating systems allows an app to add new contacts to a device without the user's permission. This happens because the system does not properly validate authorization requests.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, or watchOS 26.6 (or versions prior to these updates).
Real-world impact
A malicious application could silently populate a user's contact list with fraudulent entries, which could be used for phishing or other social engineering attacks.
Why this severity
This is a critical vulnerability because it can be exploited remotely over a network without any user interaction or special privileges, potentially compromising the integrity of the user's contact list.
What to do about it
- 011. Upgrade iOS to version 26.6 or later.
- 022. Upgrade iPadOS to version 26.6 or later.
- 033. Upgrade macOS Tahoe to version 26.6 or later.
- 044. Upgrade visionOS to version 26.6 or later.
- 055. Upgrade watchOS to version 26.6 or later.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- support.apple.com/en-us/128066release notesvendor advisory
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128068release notesvendor advisory
- support.apple.com/en-us/128070release notesvendor advisory