{"id":"CVE-2026-86977","kind":"vulnerability","aliases":["CVE-2026-86977"],"related":[],"title":"Apple iOS and iPadOS: network restriction flaw lets apps place calls or send messages","description":"An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.","summary":"An authorization issue in Apple iOS and iPadOS let an app initiate calls or send messages without the needed permission. The fix is in iOS 27 and iPadOS 27, and the sources give no further detail on the exploit path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","ios","ipados"],"not_affected_if":[],"how_to_check":"- Check the device version in Settings > General > About; the sources do not name the affected builds\n- unknown","fix":"- Update iOS and iPadOS to 27 or later, the release the sources name as fixed\n- unknown","status":"open","published_at":"2026-10-20T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T05:04:56+00:00","updated_at":"2026-10-25T05:04:56+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:04:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to 27 or later, the release the sources name as fixed\n- unknown","reach":"local","title":"Apple iOS and iPadOS: network restriction flaw lets apps place calls or send messages","impact":"medium","summary":"An authorization issue in Apple iOS and iPadOS let an app initiate calls or send messages without the needed permission. The fix is in iOS 27 and iPadOS 27, and the sources give no further detail on the exploit path.","category":"infrastructure","nicknames":[],"who_cares":["ios","ipados","apple-devices"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Installed app places calls or sends messages without permission","analyst_note":"Find Apple's security notes for iOS 27 and the affected version range, and whether a user prompt or entitlement is required, to confirm reach and exploitation conditions.","how_to_check":"- Check the device version in Settings > General > About; the sources do not name the affected builds\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000536,"input_tokens":3248,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-86977':17A,20A '27':52B,55B,82C,85C 'abl':90C 'address':71C 'app':9A,37B,87C 'appl':1A,22B,31B 'apple-devic':21B 'author':28B,68C 'call':11A,39B,93C 'cve':15A,18A 'detail':62B 'devic':23B 'exploit':65B 'fix':48B,79C 'flaw':7A 'give':59B 'improv':73C 'infrastructur':24B 'initi':38B,92C 'io':2A,25B,32B,51B,81C 'ipado':4A,26B,34B,54B,84C 'issu':29B,69C,77C 'let':8A,35B 'may':88C 'messag':14A,42B,96C 'need':45B 'network':5A,74C 'path':66B 'permiss':46B 'place':10A 'restrict':6A,75C 'send':13A,41B,95C 'sourc':58B 'without':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86977","severity":null,"published_at":"2026-10-20T01:17:29+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}