---
id: "CVE-2026-86880"
kind: "vulnerability"
aliases: ["CVE-2026-86880"]
title: "Apple iOS and iPadOS: missing entitlement checks let apps read sensitive data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ios", "ipados", "mobile", "other"]
not_affected_if: ["updated-to-26.7.2-or-27"]
published_at: "2026-10-26T21:20:22+00:00"
first_seen_at: "2026-10-26T21:55:21+00:00"
updated_at: "2026-10-26T21:57:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86880", "first_seen_at": "2026-10-26T21:55:21+00:00"}]
---

# Apple iOS and iPadOS: missing entitlement checks let apps read sensitive data

Apple fixed a flaw where an app could access sensitive user data because an entitlement check was missing. The fix ships in iOS 26.7.2, iPadOS 26.7.2, iOS 27 and iPadOS 27.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the device version under Settings > General > About, or run `sw_vers` on a Mac-attached test device; the sources do not give a command for fleet checks
- unknown

## Fix

- Update iOS and iPadOS to `26.7.2` or later, or to `27` or later
- unknown

## Timeline

- 2026-10-26T21:55:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86880

## From the sources

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_