Apple iOS CVE-2026-86976

Exploitation requires a malicious or compromised application already installed and executing locally on the target iOS, iPadOS, or macOS device (CVSS AV:L, PR:L); the flaw is an improper authorization/state-management check that lets such an app read sensitive user data it should not be authorized to access. No user interaction beyond running the app is required (UI:N). Exploitation is LIMITED by the need for on-device app execution - a remote, network-only attacker cannot trigger it - and by the fix shipping in iOS 27, iPadOS 27, and macOS 27, so patched devices are not affected. SSVC rates it non-automatable, meaning it cannot be reliably weaponized at scale.

This is a genuinely moderate, not high, priority issue and the available signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local vulnerability requiring an attacker to already have low-privilege code execution on the device - i.e., a malicious or compromised app - with high confidentiality impact but no integrity or availability impact. CISA's SSVC framework reinforces a lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale because it needs an app on the target device), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score provided, and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one tension worth flagging: the input Tags label this an 'Authentication Bypass,' but the Apple description and CWE-285 (Improper Authorization) describe an authorization/state-management flaw, not an authentication bypass - these are distinct and the tag overstates the nature of the issue. Overall, the local attack vector and app-prerequisite meaningfully cap real-world risk despite high confidentiality impact.

A user installs a seemingly legitimate but malicious app from an attacker, or an attacker leverages an already-compromised app on the device. Because of an improper authorization/state-management check (CVSS AV:L, PR:L, UI:N), that app reads sensitive user data it should not be entitled to, without further user interaction. No public exploit code has been identified at time of analysis.