---
id: "CVE-2026-86977"
kind: "vulnerability"
aliases: ["CVE-2026-86977"]
title: "Apple iOS and iPadOS: network restriction flaw lets apps place calls or send messages"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple-devices", "infrastructure", "ios", "ipados"]
not_affected_if: []
published_at: "2026-10-20T01:17:29+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T05:04:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86977", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Apple iOS and iPadOS: network restriction flaw lets apps place calls or send messages

An authorization issue in Apple iOS and iPadOS let an app initiate calls or send messages without the needed permission. The fix is in iOS 27 and iPadOS 27, and the sources give no further detail on the exploit path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the device version in Settings > General > About; the sources do not name the affected builds
- unknown

## Fix

- Update iOS and iPadOS to 27 or later, the release the sources name as fixed
- unknown

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86977

## From the sources

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_