---
id: "CVE-2026-86978"
kind: "vulnerability"
aliases: ["CVE-2026-86978"]
title: "Apple iOS, iPadOS, macOS and tvOS: apps can read sensitive user data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "infrastructure", "ios", "ipados", "macos", "mobile-devices", "tvos"]
not_affected_if: ["already-on-27.2"]
published_at: "2026-10-26T21:20:36+00:00"
first_seen_at: "2026-10-26T21:55:22+00:00"
updated_at: "2026-10-26T21:56:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86978", "first_seen_at": "2026-10-26T21:55:22+00:00"}]
---

# Apple iOS, iPadOS, macOS and tvOS: apps can read sensitive user data

Apple's advisory says a malicious or compromised app may be able to access sensitive user data on iOS 27, iPadOS 27, macOS Golden Gate 27 and tvOS 27 before version 27.2. The advisory gives no detail on which data or how the access works.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the device OS version in Settings > General > About (iOS, iPadOS, tvOS) or Apple menu > About This Mac (macOS)
- Compare the installed version against `27.2` in the fix list

## Fix

- Update iOS and iPadOS to `27.2`
- Update macOS Golden Gate to `27.2`
- Update tvOS to `27.2`

## Timeline

- 2026-10-26T21:55:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86978

## From the sources

This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An app may be able to access sensitive user data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_