CVE-2026-84493

Received Received - Intake

Authentication Bypass in iOS and iPadOS via Bluetooth

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apple Inc.

Description

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-84493

EUVD

EUVD-2026-110401

Affected Vendors & Products

Vendor	Product	Version / Range
Apple	iOS and iPadOS	0
Apple	iOS and iPadOS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication issue caused by poor state management. It allows a malicious app to access Bluetooth functionality on affected devices without the user's consent.

Impact Analysis

A malicious app could exploit this to gain unauthorized access to Bluetooth features on your device, potentially leading to data theft or unauthorized device control.

Mitigation Strategies

Update iOS to version 26.7.2 or later and iPadOS to version 26.7.2 or later. Alternatively, update to iOS 27.2 or later and iPadOS 27.2 or later to address the authentication issue that could allow unauthorized Bluetooth access.

Hi! I’m here to help you understand CVE-2026-84493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70