Apple iOS CVE-2026-86897

Requires a malicious app to be installed and executed locally on the victim's Apple device (AV:L, UI:R) - there is no remote or network-triggered path. The app then abuses a missing entitlement check to reach data it should not be authorized to access. Limiting factors: the attacker must first get their app onto the device and have the user run it, and impact is confined to reading sensitive user data (C:H) with no integrity or availability effect. Fixed configurations are Safari 27, iOS/iPadOS 26.7 and 27, macOS Golden Gate 27, and visionOS 27; devices on those or later builds are not exposed.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) describes a LOCAL attack requiring a malicious application to already be installed and run on the device (UI:R), with confidentiality-only impact (C:H, I:N, A:N) and no scope change - a data-disclosure/privacy flaw rooted in a missing entitlement check (CWE-862), not remote code execution. The 5.5 (medium) base score is well-calibrated: it is capped by the local vector and single-impact profile. Corroborating signals reinforce low real-world urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public exploit code identified. The one point of friction is the 'Authentication Bypass' tag, which overstates the flaw - this is a missing-authorization/entitlement gap enabling data access, not a login/authentication bypass. Overall this is a routine privacy hardening fix, not an emergency; patch it in normal cadence.

A user is tricked into installing a malicious or repackaged app from outside vetted channels (or a legitimate-looking app that abuses the gap). Once run on the device, the app leverages the missing entitlement check to read sensitive user data it was never authorized to access, without triggering a permission prompt. No public exploit code has been identified, and exploitation requires local presence of the attacker's app.