{"id":"CVE-2026-86961","kind":"vulnerability","aliases":["CVE-2026-86961"],"related":[],"title":"Apple iOS and macOS: race condition lets malicious app escape sandbox","description":"A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.","summary":"A race condition in Apple's operating systems lets a malicious app break out of its sandbox. Apple fixed it with additional validation in iOS 27, iPadOS 27 and macOS Golden Gate 27.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados","macos"],"not_affected_if":["already-on-fixed-release"],"how_to_check":"- Check the device OS version in Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS)\n- unknown","fix":"- Update iOS and iPadOS to `27` or later\n- Update macOS to Golden Gate `27` or later\n- unknown","status":"open","published_at":"2026-10-20T01:17:28+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:10+00:00","updated_at":"2026-10-25T03:10:10+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:10:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27` or later\n- Update macOS to Golden Gate `27` or later\n- unknown","reach":"local","title":"Apple iOS and macOS: race condition lets malicious app escape sandbox","impact":"high","summary":"A race condition in Apple's operating systems lets a malicious app break out of its sandbox. Apple fixed it with additional validation in iOS 27, iPadOS 27 and macOS Golden Gate 27.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"malicious app escapes sandbox and reaches protected system resources","analyst_note":"Check Apple's security release notes for the affected version range and whether the fix is in the iOS 27 release for all devices; the NVD entry gives no versions.","how_to_check":"- Check the device OS version in Settings > General > About (iOS/iPadOS) or Apple menu > About This Mac (macOS)\n- unknown","needs_analyst":true,"not_affected_if":["already-on-fixed-release"],"who_is_affected":"Apple devices running iOS, iPadOS or macOS builds before the 27 releases are exposed to any installed app that can exploit the race condition. Sources do not say which earlier versions are affected or whether managed fleets need extra steps. Devices already on the fixed releases are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000595,"input_tokens":3259,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86961':14A,17A '27':50B,52B,57B,72C,75C,79C 'abl':85C 'addit':46B,64C 'address':62C 'app':9A,36B,82C 'appl':1A,19B,29B,42B 'apple-devic':18B 'break':37B,87C 'condit':6A,27B,60C 'cve':12A,15A 'devic':20B 'escap':10A 'fix':43B,69C 'gate':56B,78C 'golden':55B,77C 'infrastructur':21B 'io':2A,22B,49B,71C 'ipado':23B,51B,74C 'issu':67C 'let':7A,33B 'maco':4A,24B,54B,76C 'malici':8A,35B,81C 'may':83C 'oper':31B 'race':5A,26B,59C 'sandbox':11A,41B,91C 'system':32B 'valid':47B,65C","nicknames":[],"mitigations":[],"who_affected":"Apple devices running iOS, iPadOS or macOS builds before the 27 releases are exposed to any installed app that can exploit the race condition. Sources do not say which earlier versions are affected or whether managed fleets need extra steps. Devices already on the fixed releases are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86961","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86961","severity":null,"published_at":"2026-10-20T01:17:28+00:00","modified_at":"2026-10-21T04:18:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}