CVE-2026-43679

LowCVSS 2.4

Published: 21/08/2026(UTC)Updated: 18/10/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

Risk Assessment

A person with physical access to the device could access private contact data, compromising user privacy.

Recommendation

Update watchOS to version 26.4 or later.

Other vulnerabilities in watchOS

CVE-2025-43459Medium
An authentication issue in watchOS was addressed with improved state management. The vulnerability affects watchOS 26.1 and earlier; an attacker with physical access to a locked Apple Watch may view Live Voicemail.

Original NVD description (English source)

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS