Keychain Credential Deletion in Apple iOS and iPadOS

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Apple Inc.

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-86905

Affected Vendors & Products

Vendor	Product	Version / Range
apple	ios	27
apple	ipad_os	27
apple	macos_golden_gate	27
apple	visionos	27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allowed an app to delete credentials stored in Keychain. It was addressed by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Impact Analysis

If exploited, this vulnerability could allow an attacker to delete stored credentials from Keychain, potentially leading to unauthorized access to sensitive data or accounts.

Mitigation Strategies

Update affected systems to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 to remove the vulnerable code. This addresses the issue by fixing the underlying flaw.

Hi! I’m here to help you understand CVE-2026-86905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70