Live › vulnerability › CVE-2026-86989
Go to dashboardAn authorization weakness in iOS and iPadOS, fixed with improved state management, lets an app fingerprint the device user. The sources do not describe the exact data exposed or the trigger conditions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:55 UTC. All times on this page are UTC.
Users and fleets running iOS or iPadOS builds older than the fixed versions. The sources do not say whether any app configuration or permission is required to trigger the fingerprinting, so unknown beyond that. Managed fleets should confirm OS versions through their MDM.
No product ranges from the sources yet.
26.7.2 or later on iPhone, or 27.2 or later on the iOS 27 line.26.7.2 or later, or 27.2 or later on the iPadOS 27 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
This page as .md · .json · in your agent: get_signal("CVE-2026-86989")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.