Live › vulnerability › CVE-2026-112652
Go to dashboardApple's advisory says a logic flaw in state management lets a malicious app bypass certificate validation on iOS, iPadOS, macOS and visionOS. An attacker who gets a malicious app onto a device could impersonate servers and intercept connections that rely on that validation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any device running the listed Apple operating systems before the fixed versions can be affected, since the flaw sits in the OS. Managed fleets should prioritize devices that handle sensitive network traffic. Devices already on the fixed versions can skip this.
No product ranges from the sources yet.
sw_vers -productVersion on macOS, and compare it to the fixed versions below.26.7.2 or 27.2.26.7.2, macOS Sequoia to 15.8.2, and macOS Golden Gate to 27.2.27.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A logic issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An malicious app may be able to bypass certificate validation.
This page as .md · .json · in your agent: get_signal("CVE-2026-112652")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.