---
id: CVE-2026-65355
title: An information disclosure issue was addressed with improved state management
summary: >-
  An information disclosure issue was addressed with improved state management.
  This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS
  26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to
  determine a …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-642
vendor: apple
product: ipados
affected:
  - ipados < 18.7.10
  - 'ipados >= 26.0, < 26.6.1'
  - iphone_os < 18.7.10
  - 'iphone_os >= 26.0, < 26.6.1'
  - macos < 26.6.2
  - visionos < 26.6.1
patched:
  - ipados 26.6.1
  - iphone_os 26.6.1
  - macos 26.6.2
  - visionos 26.6.1
published: '2026-09-14'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T19:29:14.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65355'
references:
  - url: 'https://support.apple.com/en-us/148281'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/148282'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/148287'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/148353'
    label: product-security@apple.com
tags:
  - nvd
  - cve.org
epss: 0.0034
epssPercentile: 0.24609
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T22:53:06.766711Z'
ingestedAt: '2026-09-14T21:15:17.537Z'
---

## Overview

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on.

## Affected

- `ipados < 18.7.10`
- `ipados >= 26.0, < 26.6.1`
- `iphone_os < 18.7.10`
- `iphone_os >= 26.0, < 26.6.1`
- `macos < 26.6.2`
- `visionos < 26.6.1`

## Remediation

Upgrade past the affected range:

- `ipados 26.6.1`
- `iphone_os 26.6.1`
- `macos 26.6.2`
- `visionos 26.6.1`