{"id":"CVE-2026-86880","kind":"vulnerability","aliases":["CVE-2026-86880"],"related":[],"title":"Apple iOS and iPadOS: missing entitlement checks let apps read sensitive data","description":"This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.","summary":"Apple fixed a flaw where an app could access sensitive user data because an entitlement check was missing. The fix ships in iOS 26.7.2, iPadOS 26.7.2, iOS 27 and iPadOS 27.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","ipados","mobile","other"],"not_affected_if":["updated-to-26.7.2-or-27"],"how_to_check":"- Check the device version under Settings > General > About, or run `sw_vers` on a Mac-attached test device; the sources do not give a command for fleet checks\n- unknown","fix":"- Update iOS and iPadOS to `26.7.2` or later, or to `27` or later\n- unknown","status":"open","published_at":"2026-10-26T21:20:22+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:00+00:00","updated_at":"2026-10-26T21:57:00+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-26T21:57:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or later, or to `27` or later\n- unknown","reach":"local","title":"Apple iOS and iPadOS: missing entitlement checks let apps read sensitive data","impact":"medium","summary":"Apple fixed a flaw where an app could access sensitive user data because an entitlement check was missing. The fix ships in iOS 26.7.2, iPadOS 26.7.2, iOS 27 and iPadOS 27.","category":"other","nicknames":[],"who_cares":["ios","ipados","mobile"],"confidence":0.4,"needs_auth":"unknown","worst_case":"A malicious or compromised app reads sensitive user data on the device.","analyst_note":"Check Apple's security notes for CVE-2026-86880 to confirm the affected component, the data exposed, and whether user interaction or a specific app is required.","how_to_check":"- Check the device version under Settings > General > About, or run `sw_vers` on a Mac-attached test device; the sources do not give a command for fleet checks\n- unknown","needs_analyst":true,"not_affected_if":["updated-to-26.7.2-or-27"],"who_is_affected":"Any iPhone or iPad running an iOS or iPadOS build older than 26.7.2 (or older than 27) can be affected, since the sources describe an app reaching sensitive user data. The sources do not say which app conditions or data types are involved, so unknown whether managed or enterprise devices differ.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3265,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86880':15A,18A '26.7.2':45B,47B,67C,70C '27':49B,52B,72C,75C 'abl':80C 'access':30B,82C 'addit':58C 'address':56C 'app':9A,28B,77C 'appl':1A,22B 'check':7A,37B,60C 'could':29B 'cve':13A,16A 'data':12A,33B,85C 'entitl':6A,36B,59C 'fix':23B,41B,64C 'flaw':25B 'io':2A,19B,44B,48B,66C,71C 'ipado':4A,20B,46B,51B,69C,74C 'issu':54C,62C 'let':8A 'may':78C 'miss':5A,39B 'mobil':21B 'read':10A 'sensit':11A,31B,83C 'ship':42B 'user':32B,84C","nicknames":[],"mitigations":[],"who_affected":"Any iPhone or iPad running an iOS or iPadOS build older than 26.7.2 (or older than 27) can be affected, since the sources describe an app reaching sensitive user data. The sources do not say which app conditions or data types are involved, so unknown whether managed or enterprise devices differ.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86880","severity":null,"published_at":"2026-10-26T21:20:22+00:00","modified_at":"2026-10-26T21:20:22+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}