{"id":"CVE-2026-86978","kind":"vulnerability","aliases":["CVE-2026-86978"],"related":[],"title":"Apple iOS, iPadOS, macOS and tvOS: apps can read sensitive user data","description":"This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An app may be able to access sensitive user data.","summary":"Apple's advisory says a malicious or compromised app may be able to access sensitive user data on iOS 27, iPadOS 27, macOS Golden Gate 27 and tvOS 27 before version 27.2. The advisory gives no detail on which data or how the access works.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","ios","ipados","macos","mobile-devices","tvos"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the device OS version in Settings > General > About (iOS, iPadOS, tvOS) or Apple menu > About This Mac (macOS)\n- Compare the installed version against `27.2` in the fix list","fix":"- Update iOS and iPadOS to `27.2`\n- Update macOS Golden Gate to `27.2`\n- Update tvOS to `27.2`","status":"open","published_at":"2026-10-26T21:20:36+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","triaged_at":"2026-10-26T21:56:33+00:00","updated_at":"2026-10-26T21:56:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:56:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27.2`\n- Update macOS Golden Gate to `27.2`\n- Update tvOS to `27.2`","reach":"local","title":"Apple iOS, iPadOS, macOS and tvOS: apps can read sensitive user data","impact":"medium","summary":"Apple's advisory says a malicious or compromised app may be able to access sensitive user data on iOS 27, iPadOS 27, macOS Golden Gate 27 and tvOS 27 before version 27.2. The advisory gives no detail on which data or how the access works.","category":"infrastructure","nicknames":[],"who_cares":["apple","ios","ipados","macos","tvos","mobile-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"An installed app reads sensitive user data it should not reach","analyst_note":"Check Apple's security notes for CVE-2026-86978 to confirm the affected data types, required app permissions and whether user interaction is needed.","how_to_check":"- Check the device OS version in Settings > General > About (iOS, iPadOS, tvOS) or Apple menu > About This Mac (macOS)\n- Compare the installed version against `27.2` in the fix list","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Owners and administrators of Apple devices running iOS 27, iPadOS 27, macOS Golden Gate 27 or tvOS 27 before 27.2. The sources do not say which data types or app permissions are involved, so whether a given device or fleet is exposed beyond the version check is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3261,"output_tokens":601,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86978':15A,18A '27':47B,49B,53B,56B '27.2':59B,86C,89C,93C,95C 'abl':39B,100C 'access':41B,71B,102C 'address':76C 'advisori':30B,61B 'app':7A,36B,97C 'appl':1A,19B,28B 'check':79C 'compromis':35B 'cve':13A,16A 'data':12A,44B,67B,105C 'detail':64B 'devic':26B 'fix':83C 'gate':52B,92C 'give':62B 'golden':51B,91C 'improv':78C 'infrastructur':20B 'io':2A,21B,46B,85C 'ipado':3A,22B,48B,88C 'issu':74C,81C 'maco':4A,23B,50B,90C 'malici':33B 'may':37B,98C 'mobil':25B 'mobile-devic':24B 'read':9A 'say':31B 'sensit':10A,42B,103C 'tvos':6A,27B,55B,94C 'user':11A,43B,104C 'version':58B 'work':72B","nicknames":[],"mitigations":[],"who_affected":"Owners and administrators of Apple devices running iOS 27, iPadOS 27, macOS Golden Gate 27 or tvOS 27 before 27.2. The sources do not say which data types or app permissions are involved, so whether a given device or fleet is exposed beyond the version check is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86978","severity":null,"published_at":"2026-10-26T21:20:36+00:00","modified_at":"2026-10-26T21:20:36+00:00","first_seen_at":"2026-10-26T21:55:22+00:00","fetched_at":"2026-10-26T21:55:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}