CVE-2026-86966

Received Received - Intake

Improper symlink handling in Apple iOS and macOS

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Apple Inc.

Description

This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to modify protected parts of the file system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-26

Last Modified

2026-10-26

Generated

2026-10-27

AI Q&A

2026-10-27

EPSS Evaluated

N/A

NVD

CVE-2026-86966

EUVD

EUVD-2026-110224

Affected Vendors & Products

Vendor	Product	Version / Range
Apple	iOS and iPadOS	0
Apple	iOS and iPadOS	0
Apple	macOS	0
Apple	macOS	0
Apple	macOS	0
Apple	visionOS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of symbolic links (symlinks) in Apple operating systems. An attacker could exploit this to modify protected parts of the file system, potentially bypassing security restrictions.

Impact Analysis

An app exploiting this could alter critical system files or user data, leading to unauthorized access, data corruption, or system instability. Users may experience crashes, data loss, or compromised security.

Mitigation Strategies

Update affected systems to the latest patched versions: iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, or visionOS 27.

Hi! I’m here to help you understand CVE-2026-86966. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70