CVE-2026-86905

Analyzed Analyzed - Analysis Complete

Keychain Credential Deletion in Apple iOS and iPadOS

Publication date: 2026-09-14

Last updated on: 2026-09-16

Assigner: Apple Inc.

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-16

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-86905

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ipados	to 27.0 (exc)
apple	iphone_os	to 27.0 (exc)
apple	macos	to 27.0 (exc)
apple	visionos	to 27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability allowed an app to delete credentials stored in Keychain. It was addressed by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Detection Guidance

This vulnerability was addressed by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. Detection would involve checking if your system is running an affected version prior to these updates. No specific commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to delete stored credentials from Keychain, potentially leading to unauthorized access to sensitive data or accounts.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability involves an app potentially deleting Keychain credentials, but no details are given about data exposure or privacy violations that would typically affect such regulations.

Mitigation Strategies

Update affected systems to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 to remove the vulnerable code. This addresses the issue by fixing the underlying flaw.

Hi! I’m here to help you understand CVE-2026-86905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70