{"id":"CVE-2026-86963","kind":"vulnerability","aliases":["CVE-2026-86963"],"related":[],"title":"Apple iOS and iPadOS: input validation flaw enables network denial-of-service","description":"A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker in a privileged network position may be able to cause a denial-of-service.","summary":"Apple fixed a denial-of-service flaw in iOS and iPadOS that is addressed by improved input validation. An attacker in a privileged network position may be able to crash or disrupt affected devices.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","ipados","mobile-devices"],"not_affected_if":["already-updated-devices"],"how_to_check":"- Open Settings > General > About on the device and read the iOS or iPadOS version\n- unknown for fleet-wide checks: the sources do not name an MDM or inventory command","fix":"- Update iOS and iPadOS to `26.7` or later on iPhone and iPad devices\n- Update to iOS 27 or iPadOS 27 where the device supports it","status":"open","published_at":"2026-10-20T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:08:42+00:00","updated_at":"2026-10-25T04:08:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:08:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7` or later on iPhone and iPad devices\n- Update to iOS 27 or iPadOS 27 where the device supports it","reach":"network","title":"Apple iOS and iPadOS: input validation flaw enables network denial-of-service","impact":"low","summary":"Apple fixed a denial-of-service flaw in iOS and iPadOS that is addressed by improved input validation. An attacker in a privileged network position may be able to crash or disrupt affected devices.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","apple","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker disrupts device network service through denial-of-service","analyst_note":"Check Apple's security release notes for the affected component and which network protocol triggers the flaw; sources give only the NVD entry.","how_to_check":"- Open Settings > General > About on the device and read the iOS or iPadOS version\n- unknown for fleet-wide checks: the sources do not name an MDM or inventory command","needs_analyst":true,"not_affected_if":["already-updated-devices"],"who_is_affected":"Owners of iPhone and iPad devices running iOS or iPadOS releases before 26.7 or 27 are exposed. The sources describe the attacker as needing a privileged network position, so the risk is mainly on hostile or compromised networks. Organisations with managed devices should check their update policy; the sources do not say which devices or configurations are most at risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3286,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86963':16A,19A '26.7':80C,83C '27':85C,88C 'abl':55B,98C 'address':41B,69C 'affect':60B 'appl':1A,20B,27B 'attack':47B,90C 'caus':100C 'crash':57B 'cve':14A,17A 'denial':11A,31B,64C,103C 'denial-of-servic':10A,30B,63C,102C 'devic':26B,61B 'disrupt':59B 'enabl':8A 'fix':28B,77C 'flaw':7A,34B 'improv':43B,71C 'infrastructur':21B 'input':5A,44B,72C 'io':2A,22B,36B,79C,84C 'ipado':4A,23B,38B,82C,87C 'issu':67C,75C 'may':53B,96C 'mobil':25B 'mobile-devic':24B 'network':9A,51B,94C 'posit':52B,95C 'privileg':50B,93C 'servic':13A,33B,66C,105C 'valid':6A,45B,73C","nicknames":[],"mitigations":[],"who_affected":"Owners of iPhone and iPad devices running iOS or iPadOS releases before 26.7 or 27 are exposed. The sources describe the attacker as needing a privileged network position, so the risk is mainly on hostile or compromised networks. Organisations with managed devices should check their update policy; the sources do not say which devices or configurations are most at risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86963","severity":null,"published_at":"2026-10-20T01:17:29+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}