Apple iOS CVE-2026-86884

Requires a locally installed, running application on the affected Apple device (AV:L, PR:L) - the attacker must first get a malicious or compromised app onto the victim's iOS/iPadOS, macOS, tvOS, or watchOS device (e.g., via the App Store, sideloading, or enterprise/MDM distribution). No additional user interaction is needed once the app runs (UI:N). Exploitation is LIMITED to devices below version 27 of the respective OS; it does not affect visionOS (absent from CPE and EUVD). The flaw is a permissions/authorization gap that lets the app read sensitive user data it should be denied; there is no remote or network exploitation path.

This is a low-to-moderate real-world priority despite the 5.5 (MEDIUM) CVSS. Every attack-vector signal points to constrained, local exploitation: the vendor vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N requires a malicious app already running locally with low privileges, and the impact is confidentiality-only (C:H, I:N, A:N) - the app reads sensitive user data but gains no code execution, integrity, or availability impact. Corroborating this, EPSS is very low at 0.16% (6th percentile), there is NO CISA KEV listing, and no public POC was identified. There is no SSVC data provided. Note a labeling conflict: the input Tags mark this 'Privilege Escalation' and the CWE is CWE-269 (Improper Privilege Management), but the actual described impact and CVSS (C:H/I:N/A:N, S:U) is a confidentiality-only information-disclosure - not a true privilege escalation with integrity/availability gain; treat the 'Privilege Escalation' framing with skepticism. Overall: a genuine but low-urgency data-access flaw, best handled via routine patching to OS version 27, not emergency response.

A user installs a seemingly benign app from the App Store or via sideloading/enterprise distribution. Because of an insufficient permissions restriction, that app - running with normal low privileges and no additional user interaction - reads sensitive user data it should not have access to. No public exploit code exists at time of analysis, and exploitation requires the attacker to first get their app onto the victim's device.