CVE-2026-86884

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/149034	Vendor Advisory
https://support.apple.com/en-us/149035	Vendor Advisory
https://support.apple.com/en-us/149036	Vendor Advisory
https://support.apple.com/en-us/149037	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

18 Sep 2026, 14:08

Type	Values Removed	Values Added
CPE		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:watchos:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:tvos::::::::
First Time		Apple watchos Apple ipados Apple Apple macos Apple tvos Apple iphone Os
References	~~() https://support.apple.com/en-us/149034 -~~	() https://support.apple.com/en-us/149034 - Vendor Advisory
References	~~() https://support.apple.com/en-us/149035 -~~	() https://support.apple.com/en-us/149035 - Vendor Advisory
References	~~() https://support.apple.com/en-us/149036 -~~	() https://support.apple.com/en-us/149036 - Vendor Advisory
References	~~() https://support.apple.com/en-us/149037 -~~	() https://support.apple.com/en-us/149037 - Vendor Advisory

17 Sep 2026, 15:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		CWE-269

Information

Published : 2026-09-14 21:17

Updated : 2026-09-18 14:08

NVD link : CVE-2026-86884

Mitre link : CVE-2026-86884

CVE.ORG link : CVE-2026-86884

JSON object : View

Products Affected

apple

macos
iphone_os
watchos
ipados
tvos

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-86884", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86884", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T14:50:08.504536Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "tvOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}, {"vendor": "Apple", "product": "watchOS", "versions": [{"status": "affected", "version": "0", "lessThan": "27", "versionType": "custom"}]}]}], "published": "2026-09-14T21:17:39.340", "references": [{"url": "https://support.apple.com/en-us/149034", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149035", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149036", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149037", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data."}], "lastModified": "2026-09-18T14:08:20.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6CD209B-5C42-4CC2-BF07-60852D12509A", "versionEndExcluding": "27.0"}, {"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A74637E-2BC7-477F-8996-32A3BE7A10DC", "versionEndExcluding": "27.0"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FD79C64-A33E-4DDB-BDE6-4E272788FF66", "versionEndExcluding": "27.0"}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BD26C5D-C2F6-4BB6-A1E6-1F5723EA7458", "versionEndExcluding": "27.0"}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52C964A6-6BF4-4C0A-9C20-FBDE815AE5DF", "versionEndExcluding": "27.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}