{"id":"CVE-2026-112707","kind":"vulnerability","aliases":["CVE-2026-112707"],"related":[],"title":"Apple iOS and iPadOS: apps can list other installed apps","description":"A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.","summary":"A privacy flaw in iOS and iPadOS let an app identify which other apps the user has installed. Apple fixed it by moving the sensitive data to a protected location.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ios","ipados","mobile-fleet"],"not_affected_if":["already-patched"],"how_to_check":"- Check the device OS version in Settings > General > About; unknown whether the sources give a further check\n- unknown","fix":"- Update iOS to `26.7.2` or later on iOS 26 devices, or `27.2` or later on iOS 27 devices\n- Update iPadOS to `26.7.2` or later on iPadOS 26 devices, or `27.2` or later on iPadOS 27 devices","status":"open","published_at":"2026-10-26T21:18:05+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","triaged_at":"2026-10-26T21:23:11+00:00","updated_at":"2026-10-26T21:23:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:23:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS to `26.7.2` or later on iOS 26 devices, or `27.2` or later on iOS 27 devices\n- Update iPadOS to `26.7.2` or later on iPadOS 26 devices, or `27.2` or later on iPadOS 27 devices","reach":"local","title":"Apple iOS and iPadOS: apps can list other installed apps","impact":"low","summary":"A privacy flaw in iOS and iPadOS let an app identify which other apps the user has installed. Apple fixed it by moving the sensitive data to a protected location.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","mobile-fleet"],"confidence":0.6,"needs_auth":"no","worst_case":"A installed app learns which other apps the user has installed.","analyst_note":"","how_to_check":"- Check the device OS version in Settings > General > About; unknown whether the sources give a further check\n- unknown","needs_analyst":false,"not_affected_if":["already-patched"],"who_is_affected":"Owners of iPhones and iPads on iOS or iPadOS versions before the fixed releases can be affected, since any installed app could run the lookup. Managed fleets should confirm devices are on the fixed versions. Devices already on the fixed versions are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.00057,"input_tokens":3287,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112707':13A,16A '-2026':12A,15A '26.7.2':72C,75C '27.2':77C,80C 'abl':85C 'address':57C 'app':5A,10A,32B,36B,82C,90C 'appl':1A,41B 'cve':11A,14A 'data':48B,61C 'fix':42B,69C 'flaw':25B 'fleet':22B 'identifi':33B,87C 'infrastructur':17B 'instal':9A,40B,94C 'io':2A,18B,27B,71C,76C 'ipado':4A,19B,29B,74C,79C 'issu':55C,67C 'let':30B 'list':7A 'locat':52B,65C 'may':83C 'mobil':21B 'mobile-fleet':20B 'move':45B,59C 'privaci':24B,54C 'protect':51B,64C 'sensit':47B,60C 'user':38B,92C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads on iOS or iPadOS versions before the fixed releases can be affected, since any installed app could run the lookup. Managed fleets should confirm devices are on the fixed versions. Devices already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112707","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112707","severity":null,"published_at":"2026-10-26T21:18:05+00:00","modified_at":"2026-10-26T21:18:05+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","fetched_at":"2026-10-26T21:20:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}