CVE-2026-86977

Analyzed Analyzed - Analysis Complete

Improper Authorization in iOS and iPadOS

Publication date: 2026-10-20

Last updated on: 2026-11-03

Assigner: Apple Inc.

Description

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-03

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-86977

EUVD

EUVD-2026-104739

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 27.0 (exc)
apple	iphone_os	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an authorization issue in iOS and iPadOS versions prior to 27. It allows an app to bypass intended restrictions and initiate calls or send messages without proper permissions.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. The description only mentions that an authorization issue was addressed with improved network restrictions in iOS 27 and iPadOS 27.

Impact Analysis

An attacker could exploit this to make unauthorized calls or send messages from your device without your knowledge, potentially leading to privacy breaches or financial charges.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The issue involves an authorization flaw allowing apps to initiate calls or send messages, but no direct compliance implications are mentioned.

Mitigation Strategies

Update to iOS 27 or iPadOS 27 to address the authorization issue and prevent unauthorized call or message initiation.

Hi! I’m here to help you understand CVE-2026-86977. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...