CVE-2026-86897

Published: Sep 14, 2026Modified: Sep 18, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.

Affected (5)

Products: Apple: Ipados, Iphone Os, Macos, Safari, Visionos

5 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	version < 26.7
Apple Iphone Os	version < 26.7
Apple Macos	version < 27.0
Apple Safari	version < 27.0
Apple Visionos	version < 27.0

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.