{"id":"CVE-2026-113908","kind":"vulnerability","aliases":["CVE-2026-113908"],"related":[],"title":"Apple iOS and iPadOS: privacy fix removes sensitive data apps could read","description":"A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.","summary":"Apple fixed a privacy issue in iOS 27.2 and iPadOS 27.2 by removing sensitive data that was exposed. The sources say an app may be able to access sensitive user data before the fix.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","ios","ipados","mobile","other"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the device version under Settings > General > About (unknown for managed fleets without a command)\n- unknown for other checks, the sources do not say","fix":"- Update iOS to `27.2` or later\n- Update iPadOS to `27.2` or later","status":"open","published_at":"2026-10-26T21:18:07+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:58+00:00","updated_at":"2026-10-26T21:21:58+00:00","category":"other","confidence":0.35,"triage":{"at":"2026-10-26T21:21:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS to `27.2` or later\n- Update iPadOS to `27.2` or later","reach":"local","title":"Apple iOS and iPadOS: privacy fix removes sensitive data apps could read","impact":"medium","summary":"Apple fixed a privacy issue in iOS 27.2 and iPadOS 27.2 by removing sensitive data that was exposed. The sources say an app may be able to access sensitive user data before the fix.","category":"other","nicknames":[],"who_cares":["ios","ipados","apple-devices","mobile"],"confidence":0.35,"needs_auth":"unknown","worst_case":"A installed app reads sensitive user data it should not reach","analyst_note":"Find Apple's security content page for iOS 27.2 and iPadOS 27.2 to confirm the affected component, required permissions and whether it is fixed in that release.","how_to_check":"- Check the device version under Settings > General > About (unknown for managed fleets without a command)\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Owners of iPhones and iPads running iOS or iPadOS builds older than 27.2. The sources do not say which data or which app permissions are involved, so teams cannot tell whether managed apps are exposed beyond the device version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000578,"input_tokens":3250,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113908':15A,18A '-2026':14A,17A '27.2':32B,35B,74C,77C 'abl':50B,82C 'access':52B,84C 'address':63C 'app':10A,47B,79C 'appl':1A,20B,25B 'apple-devic':19B 'could':11A 'cve':13A,16A 'data':9A,39B,55B,67C,87C 'devic':21B 'expos':42B 'fix':6A,26B,58B,71C 'io':2A,22B,31B,73C 'ipado':4A,23B,34B,76C 'issu':29B,61C,69C 'may':48B,80C 'mobil':24B 'privaci':5A,28B,60C 'read':12A 'remov':7A,37B,65C 'say':45B 'sensit':8A,38B,53B,66C,85C 'sourc':44B 'user':54B,86C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhones and iPads running iOS or iPadOS builds older than 27.2. The sources do not say which data or which app permissions are involved, so teams cannot tell whether managed apps are exposed beyond the device version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113908","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113908","severity":null,"published_at":"2026-10-26T21:18:07+00:00","modified_at":"2026-10-26T21:18:07+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}