CVE-2026-86961

Analyzed Analyzed - Analysis Complete

Race Condition in iOS and iPadOS 27

Publication date: 2026-10-20

Last updated on: 2026-11-02

Assigner: Apple Inc.

Description

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-02

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-86961

EUVD

EUVD-2026-104734

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 27.0 (exc)
apple	iphone_os	to 27.0 (exc)
apple	macos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

A race condition vulnerability in Apple's operating systems (iOS, iPadOS, macOS) could allow a malicious app to escape its sandbox restrictions. This flaw was addressed with additional validation in iOS 27, iPadOS 27, and macOS Golden Gate 27.

Detection Guidance

This vulnerability is a race condition in Apple operating systems that allows sandbox escape. Detection requires checking system versions against patched releases. For iOS/iPadOS, verify if version is 27 or later. For macOS, check if version is Golden Gate 27 or later. No specific commands are provided in the context for detection.

Impact Analysis

If exploited, this vulnerability could let a malicious app bypass security boundaries, potentially accessing sensitive data or performing unauthorized actions on your device. Users should update to the latest OS versions to mitigate this risk.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves a race condition allowing sandbox escape, which could potentially lead to unauthorized data access, but no explicit compliance implications are mentioned.

Mitigation Strategies

Update affected Apple devices to iOS 27, iPadOS 27, or macOS Golden Gate 27 to address the race condition and sandbox escape issue.

Hi! I’m here to help you understand CVE-2026-86961. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...