CVE-2026-64707
A permissions issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6,
CVSS
5.5
Medium
EPSS
0.2%
p5
KEV
—
Exploit Today
1
0-100
Published: Jul 27, 2026 · Last modified: Aug 17, 2026 · CWE-732
0.2%EPSS · 30 days0.2%
2026-10-032026-10-31
A permissions issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6. An app may be able to delete files for which it does not have permission.
- support.apple.comhttps://support.apple.com/en-us/128066
- support.apple.comhttps://support.apple.com/en-us/128067
- support.apple.comhttps://support.apple.com/en-us/128070
- support.apple.comhttps://support.apple.com/en-us/128071
- support.apple.comhttps://support.apple.com/en-us/128072
- support.apple.comhttps://support.apple.com/en-us/148287
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1114995.5 MED3.2%
——1Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.2dCVE-2026-118574—2.8%
——1Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.2dCVE-2026-1070609.1 CRI20.1%
——6Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.2dCVE-2026-1070557.5 HIG17.3%
——5Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.2dCVE-2026-1070477.5 HIG37.8%
——11Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.2dCVE-2026-1070447.5 HIG24.0%
——7Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.2d