Apple iOS CVE-2026-86888

Requires a local, low-privilege app already installed and running on the affected Apple device (AV:L, PR:L) - there is no remote or network vector and no user interaction beyond running the app. The app leverages a permissions weakness to read a persistent account identifier it should not be authorized to access. Limiting factors: attacker must first get a malicious app onto the device (App Store review, sideloading constraints, or MDM), impact is confined to disclosure of an identifier (C:L only, no write or system compromise), and the flaw is fixed in iOS/iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, and tvOS/visionOS/watchOS 27, so patched devices are not exposed.

This is a genuinely low-priority issue, and all signals agree. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a base score of 3.3 (LOW), reflecting a local-only, low-privilege attack with only limited confidentiality impact (C:L, no integrity or availability impact). EPSS is 0.19% (9th percentile), consistent with the low CVSS and the local vector - mass exploitation is implausible for a bug requiring code already running on the device. There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' The impact is narrow: a local app reads a persistent account identifier, which is a privacy/tracking concern (cross-app or cross-reset user correlation) rather than a path to credential theft or code execution. Note a labeling gap: the CVSS C:L rating scores this below its sensitive-data sibling CVEs (which are C:H/5.5) precisely because a persistent identifier is a smaller leak than full user data - that distinction is correct here. No key signals conflict; the only data note is that CWE is N/A in the input (a privacy exposure, CWE-359/CWE-200, would fit).

A user installs a seemingly benign app from the App Store; once running locally on the device, the app abuses insufficient permission restrictions to read a persistent account identifier it should not have access to. It uses that stable identifier to fingerprint and track the user across app installs or resets, or correlates the user across data brokers, defeating Apple's privacy boundaries. No public exploit code is known, and the attack requires the malicious app to already be running locally.