CVE-2026-86905

Published: Sep 14, 2026Modified: Sep 16, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

Affected (4)

Products: Apple: Ipados, Iphone Os, Macos, Visionos

4 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	version < 27.0
Apple Iphone Os	version < 27.0
Apple Macos	version < 27.0
Apple Visionos	version < 27.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://support.apple.com/en-us/149034

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/en-us/149035

Source: product-security@apple.com

Vendor Advisory

https://support.apple.com/en-us/149038

Source: product-security@apple.com

Vendor Advisory

Timeline

No history available yet.