CVE-2026-43679 Apple CVE debrief

Who should care

Administrators and users of Apple Watch devices running watchOS 26.3 or earlier should be aware of this issue and take necessary precautions. Operators of managed environments should review device deployments and assign owners for follow-up. Vulnerability management and security teams should prioritize patching and monitor for suspicious activity related to locked devices.

Technical summary

The issue, addressed in watchOS 26.4, involves improved permissions checking to prevent potential unauthorized access to user contacts on a locked Apple Watch by an attacker with physical access. This change enhances the security posture of Apple Watch devices by ensuring that sensitive information remains protected even when the device is locked. The fix prevents an attacker with physical access from viewing user contacts on a locked device, improving the overall security of Apple Watch devices.

Defensive priority

Low-priority defensive review recommended due to low CVSS score and limited attack surface.

Recommended defensive actions

• Verify watchOS version and apply update if necessary
• Enforce strong authentication and authorization mechanisms
• Monitor for suspicious activity related to locked devices
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; primary official records indicate an issue addressed with improved permissions checking in watchOS 26.4, potentially allowing a physically proximate attacker to view user contacts on a locked Apple Watch. Defenders should verify official vendor guidance and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.