Live › vulnerability › CVE-2026-86990
Go to dashboardA flaw in Apple's operating systems lets a malicious app access the camera without the user's permission. The attacker gets the camera feed from a device running the affected software, which is limited to the device's own camera.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:55 UTC. All times on this page are UTC.
Any team that issues or relies on Apple devices (iPhone, iPad, Mac, Vision Pro) running an affected OS version is exposed, since any installed app could be malicious. Servers, containers and Linux systems are not affected. Organisations with all devices already on the fixed versions can skip it.
No product ranges from the sources yet.
18.7.11, 26.7.2, 27.2, and macOS Tahoe 26.7.2 or macOS Golden Gate 27.2, visionOS 27.218.7.11, 26.7.2, or 27.2 depending on the release line26.7.2 or macOS Golden Gate to 27.227.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.
This page as .md · .json · in your agent: get_signal("CVE-2026-86990")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.