CVE-2026-86887

Published: Sep 14, 2026Modified: Sep 21, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.

Affected (3)

Products: Apple: Ipados, Iphone Os, Visionos

3 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	version < 26.7
Apple Iphone Os	version < 26.7
Apple Visionos	version < 27.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (3)

https://support.apple.com/en-us/149034

Source: product-security@apple.com

Vendor AdvisoryRelease Notes

https://support.apple.com/en-us/149038

Source: product-security@apple.com

Vendor AdvisoryRelease Notes

https://support.apple.com/en-us/149041

Source: product-security@apple.com

Vendor AdvisoryRelease Notes

Timeline

No history available yet.