Skip to main content

iOS and iPadOS EUVDEUVD-2026-78009

| CVE-2026-86890 MEDIUM
Improper Authentication (CWE-287)
2026-09-14 apple GHSA-962x-ff7c-hvm9
Authentication Bypass Apple Ios And Ipados
4.6
CVSS 3.1 · Vendor: apple
Share

Severity by source

Vendor (apple) PRIMARY
4.6 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
4.6 MEDIUM

Physical access to a locked device (AV:P) with no authentication (PR:N) or interaction; confidentiality-only, and C:H is retained per vendor though 'sensitive information' scope is unspecified and arguably C:L.

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Sep 16, 2026 - 17:08 vuln.today
CVSS changed
Sep 16, 2026 - 16:22 NVD
4.6 (MEDIUM)
Patch available
Sep 14, 2026 - 22:19 EUVD
CVE Published
Sep 14, 2026 - 20:48 cve.org
MEDIUM 4.6
CVE Published
Sep 14, 2026 - 20:48 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information.

AnalysisAI

Holding a locked iPhone or iPad, an attacker can reach a lockscreen-accessible interface that improperly passes an authentication check, allowing sensitive user information to be viewed without the passcode being entered. The flaw is a logic error classed as CWE-287 (improper authentication) that affects iOS and iPadOS builds prior to 26.7 and 27, and Apple has shipped fixes in iOS/iPadOS 26.7 and iOS/iPadOS 27, so it is fully remediated by updating. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires physical possession of the target device while it is in a LOCKED state; the attacker interacts with a lockscreen-reachable feature to bypass an authentication/authorization check (CWE-287) and view sensitive data without entering the passcode. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent and point to a LOW-to-MEDIUM real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: update to iOS 26.7 / iPadOS 26.7 or iOS 27 / iPadOS 27, as documented in Apple's advisories https://support.apple.com/en-us/149034 and https://support.apple.com/en-us/149041; patching is the only complete fix and restores the improved authentication checks. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ios And Ipados

View all
CVE-2026-43723 HIGH POC
7.8 Jul 27

Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability,
CVE-2026-65414 CRITICAL
9.8 Sep 14

An out-of-bounds write (CWE-787) in Apple's operating system family - iOS/iPadOS, macOS (Sequoia, Tahoe, and Golden Gate
CVE-2026-64771 CRITICAL
9.8 Jul 27

Memory corruption in multiple Apple operating systems allows remote attackers to trigger buffer overflows that may cause
CVE-2026-43803 CRITICAL
9.8 Jul 27

Remote system termination in multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) can be trigg
CVE-2026-43810 CRITICAL
9.8 Jul 27

Remote memory corruption in the Apple operating-system kernel (shared XNU core across iOS/iPadOS 26.6, macOS Sequoia 15.
CVE-2026-64770 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems prior to iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma
CVE-2026-64769 CRITICAL
9.8 Jul 27

Heap-based buffer overflow in Apple iOS, iPadOS, macOS, tvOS, and visionOS allows remote attackers to cause unexpected a
CVE-2026-64774 CRITICAL
9.8 Jul 27

We are tasked to produce a JSON object with specific fields based on a CVE. We must synthesize multiple intelligence sou
CVE-2026-64772 CRITICAL
9.8 Jul 27

Remote code execution in Apple operating systems (iOS, iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS) stems from an
CVE-2026-84561 CRITICAL
9.8 Sep 14

Kernel memory corruption in Apple's operating systems lets an app already running on a device trigger a double free (CWE
CVE-2026-84609 CRITICAL
9.8 Sep 14

A locally installed app on Apple iOS/iPadOS (before 27), macOS (before Golden Gate 27, Tahoe 26.7, or Sequoia 15.8), tvO
CVE-2026-43807 CRITICAL
9.8 Jul 27

Denial of service via unexpected app termination affects multiple Apple operating systems, including iOS, iPadOS, macOS,

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-78009 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy