{"id":"CVE-2026-84493","kind":"vulnerability","aliases":["CVE-2026-84493"],"related":[],"title":"Apple iOS and iPadOS: malicious app can access Bluetooth without consent","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","summary":"An authentication state-management flaw in iOS and iPadOS lets a malicious app access Bluetooth without the user's consent. The sources do not describe further impact beyond Bluetooth access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","mobile"],"not_affected_if":["already-updated-devices"],"how_to_check":"- Check the device version in Settings > General > About; the sources name iOS 26.7.2 and iPadOS 26.7.2, and iOS 27.2 and iPadOS 27.2, as the fixed releases.\n- unknown for any other check; the sources do not say.","fix":"- Update iOS and iPadOS to `26.7.2` or later on the 26.x line, or to `27.2` or later on the 27.x line.","status":"open","published_at":"2026-10-26T21:19:58+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:21+00:00","updated_at":"2026-10-26T21:57:21+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:57:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or later on the 26.x line, or to `27.2` or later on the 27.x line.","reach":"local","title":"Apple iOS and iPadOS: malicious app can access Bluetooth without consent","impact":"low","summary":"An authentication state-management flaw in iOS and iPadOS lets a malicious app access Bluetooth without the user's consent. The sources do not describe further impact beyond Bluetooth access.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","apple-devices","mobile"],"confidence":0.4,"needs_auth":"no","worst_case":"A malicious app reads or uses Bluetooth without the user's consent.","analyst_note":"Sources give no severity, CVSS or exploitation detail; check Apple's security release notes for the affected versions and the Bluetooth impact.","how_to_check":"- Check the device version in Settings > General > About; the sources name iOS 26.7.2 and iPadOS 26.7.2, and iOS 27.2 and iPadOS 27.2, as the fixed releases.\n- unknown for any other check; the sources do not say.","needs_analyst":true,"not_affected_if":["already-updated-devices"],"who_is_affected":"Owners of iPhone and iPad devices running iOS or iPadOS releases older than the fixed versions named in the sources. Organisations managing Apple devices should update them; the sources do not say whether managed-device configuration changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000606,"input_tokens":3274,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84493':14A,17A '26.7.2':71C,74C '27.2':76C,79C 'abl':85C 'access':8A,39B,55B,87C 'address':60C 'app':6A,38B,82C 'appl':1A,19B 'apple-devic':18B 'authent':26B,57C 'beyond':53B 'bluetooth':9A,40B,54B,88C 'consent':11A,45B,91C 'cve':12A,15A 'describ':50B 'devic':20B 'fix':68C 'flaw':30B 'impact':52B 'improv':62C 'infrastructur':21B 'io':2A,22B,32B,70C,75C 'ipado':4A,23B,34B,73C,78C 'issu':58C,66C 'let':35B 'malici':5A,37B,81C 'manag':29B,64C 'may':83C 'mobil':24B 'sourc':47B 'state':28B,63C 'state-manag':27B 'user':43B,90C 'without':10A,41B,89C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhone and iPad devices running iOS or iPadOS releases older than the fixed versions named in the sources. Organisations managing Apple devices should update them; the sources do not say whether managed-device configuration changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:19:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84493","severity":null,"published_at":"2026-10-26T21:19:58+00:00","modified_at":"2026-10-26T21:19:58+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}