{"id":"CVE-2026-86925","kind":"vulnerability","aliases":["CVE-2026-86925"],"related":[],"title":"Apple iOS, macOS and visionOS: app can access sensitive user data","description":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An app may be able to access sensitive user data.","summary":"Apple fixed an authorization flaw in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2 that let an app reach sensitive user data it should not see. The sources give no further technical detail about the affected component.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","macos","visionos"],"not_affected_if":["already-on-27.2-or-later"],"how_to_check":"- unknown","fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later\n- Update visionOS to `27.2` or later","status":"open","published_at":"2026-10-26T21:20:29+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:57+00:00","updated_at":"2026-10-26T21:56:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:56:57Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2` or later\n- Update macOS Golden Gate to `27.2` or later\n- Update visionOS to `27.2` or later","reach":"local","title":"Apple iOS, macOS and visionOS: app can access sensitive user data","impact":"medium","summary":"Apple fixed an authorization flaw in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2 that let an app reach sensitive user data it should not see. The sources give no further technical detail about the affected component.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","macos","visionos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Installed app reads sensitive user data it should not access","analyst_note":"Check Apple's security notes for CVE-2026-86925 to confirm the affected component, required app privileges and whether user interaction is needed.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["already-on-27.2-or-later"],"who_is_affected":"Anyone running the listed Apple operating system versions before 27.2 is potentially affected, since the flaw lets a locally installed app access sensitive user data. The sources do not say which apps or data types are involved, so the exposure for any specific device cannot be determined from this text. Devices already on 27.2 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3267,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86925':14A,17A '27.2':33B,35B,39B,42B,81C,84C,88C,90C 'abl':95C 'access':8A,97C 'address':70C 'affect':64B 'app':6A,46B,92C 'appl':1A,19B,26B 'apple-devic':18B 'author':29B,67C 'compon':65B 'cve':12A,15A 'data':11A,50B,100C 'detail':61B 'devic':20B 'fix':27B,78C 'flaw':30B 'gate':38B,87C 'give':57B 'golden':37B,86C 'improv':72C 'infrastructur':21B 'io':2A,22B,32B,80C 'ipado':23B,34B,83C 'issu':68C,76C 'let':44B 'maco':3A,24B,36B,85C 'manag':74C 'may':93C 'reach':47B 'see':54B 'sensit':9A,48B,98C 'sourc':56B 'state':73C 'technic':60B 'user':10A,49B,99C 'visiono':5A,25B,41B,89C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the listed Apple operating system versions before 27.2 is potentially affected, since the flaw lets a locally installed app access sensitive user data. The sources do not say which apps or data types are involved, so the exposure for any specific device cannot be determined from this text. Devices already on 27.2 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86925","severity":null,"published_at":"2026-10-26T21:20:29+00:00","modified_at":"2026-10-26T21:20:29+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}