CVE-2026-86921
Awaiting Analysis Awaiting Analysis - Queue

Improper File Permissions in Apple iOS and macOS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apple Inc.

Description
A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-07
NVD
CVE-2026-86921
EUVD
EUVD-2026-104720

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Apple iOS and iPadOS 0
Apple iOS and iPadOS 0
Apple macOS 0
Apple visionOS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a permissions issue in Apple operating systems where improper validation allows a local attacker to overwrite restricted files. It was fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Detection Guidance

This vulnerability involves a permissions issue allowing local attackers to overwrite restricted files. Detection requires checking file permissions and system logs for unauthorized modifications. Use commands like 'ls -la /path/to/restricted/files' to verify permissions and 'find / -type f -perm -o+w' to locate writable files. Review system logs with 'log show --predicate "eventMessage CONTAINS 'overwrite'"' for suspicious activity.

Impact Analysis

A local attacker could exploit this to overwrite sensitive files on your device, potentially leading to data corruption, unauthorized access, or system instability if critical files are modified.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. The issue involves a local attacker potentially overwriting restricted files, but no direct impact on regulatory compliance is mentioned.

Mitigation Strategies

Update affected Apple devices to iOS 26.7 or later, iPadOS 26.7 or later, macOS Golden Gate 27, or visionOS 27 to address the permissions issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...