This vulnerability (CVE-2026-64733) earned a CVSS 9.8 because it represents the worst-case scenario for fingerprinting: any App Store app could collect persistent user-identifying data without requesting any special permissions. There's no exploit chain, no memory corruption, no user interaction required beyond installing the app from the store. That's what makes it critical—not technical sophistication but trivial accessibility combined with permanent tracking capability.
The fix arrived in iOS 26.6 as an 'improved data protection' change. In Apple's disclosure vocabulary, this phrase is forensic evidence: it means they moved data into a more protected class, tightening what persists in accessible storage or changing entitlement requirements. Crucially, this wasn't a permission users needed to enable—it was a default state that was too permissive. Apple's language confirms this was a design decision, not a bug: the APIs functioned exactly as designed, just in a protection domain that allowed fingerprinting by default.
For defenders, the practical steps are straightforward but essential. First, verify your managed device fleet is at iOS 26.6 or later—this is the patch that closes the vector. Second, recognize that the EPSS score (0.00462) is misleading for this vulnerability class; privacy exploits don't generate the failure signals EPSS models (unusual processes, encrypted files, network beacons). They succeed silently through normal API calls, so automated exploitation metrics systematically underweight this category. Third, understand that harvested fingerprinting data doesn't disappear when the patch ships—it was already collected, correlated, and potentially sold during the window when this vector was active across every iOS version before 26.6. The blast radius isn't just current exposure; it's the accumulated fingerprint database built during normalization.
One important inference: the absence of developer friction during the iOS 26.6 rollout suggests this was purely an abuse vector. If legitimate apps relied on this data, we'd see complaints about broken functionality. The silence indicates Apple closed an attack surface that wasn't supporting legitimate ecosystem needs—and that's the concerning part. They shipped a platform where fingerprinting was a default capability, normalized for years, then quietly closed. This isn't the last time 'improved data protection' will appear in an Apple advisory—the development philosophy that produces these vectors hasn't changed.