CVE-2026-86976

Analyzed Analyzed - Analysis Complete

Authorization Issue in iOS 27 and iPadOS 27

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: Apple Inc.

Description

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. An app may be able to access sensitive user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-03

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-86976

EUVD

EUVD-2026-104738

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 27.0 (exc)
apple	iphone_os	to 27.0 (exc)
apple	macos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is an authorization issue caused by improper state management in Apple's operating systems. It allows an app to potentially access sensitive user data without proper permissions.

Detection Guidance

This vulnerability is specific to Apple iOS, iPadOS, and macOS systems and relates to an authorization issue with sensitive data exposure. Detection requires checking system versions and app permissions rather than network commands. Verify if devices run affected versions (iOS/iPadOS 27 or macOS Golden Gate 27) and review app permissions for unauthorized data access.

Impact Analysis

If exploited, this vulnerability could let malicious apps access your private data like photos, messages, or location without your consent. It affects iOS, iPadOS, and macOS devices.

Compliance Impact

The vulnerability allows an app to access sensitive user data due to an authorization issue. This could potentially violate compliance requirements under GDPR and HIPAA, which mandate strict protection of personal and health data. Unauthorized access risks exposing protected information, leading to legal and regulatory penalties.

Mitigation Strategies

Update affected Apple devices to iOS 27, iPadOS 27, or macOS Golden Gate 27 or later to address the authorization issue.

Hi! I’m here to help you understand CVE-2026-86976. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...