AppleCVE-2026-43679

Apple watchOS: improper access control

Low2.4CVE-2026-43679 · Published Aug 21, 2026 · updated Aug 24, 2026

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

Apple advisory

Affected versions

Package	Affected	Fixed in
watchOS Product	< 26.4	26.4

Details and references

CVSS 3.1: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-284

More Apple advisories

All Apple

Date	Advisory	Severity	Fixed in
Aug 21	Apple macOS: out-of-bounds read Medium4.3Aug 21 CVE-2026-2067914.8.5+2 more	Medium4.3	14.8.5+2 more
Aug 17	Apple Safari: memory corruption Medium5.4Aug 17 CVE-2026-6534126.6.1+3 more	Medium5.4	26.6.1+3 more
Aug 17	Apple iOS and iPadOS: use after free High7.5Aug 17 CVE-2026-6534326.6.1+2 more	High7.5	26.6.1+2 more
Aug 17	Apple iOS and iPadOS: integer overflow High8.8Aug 17 CVE-2026-6534626.6.1+3 more	High8.8	26.6.1+3 more
Aug 17	Apple iOS and iPadOS: denial of service Medium6.5Aug 17 CVE-2026-6534726.6.1+2 more	Medium6.5	26.6.1+2 more
Aug 17	Apple iOS and iPadOS: out-of-bounds read Medium6.6Aug 17 CVE-2026-6534926.6.1+3 more	Medium6.6	26.6.1+3 more

Affected versions

More Apple advisories

Critical advisories by email