CVE-2026-86887 Overview
CVE-2026-86887 is a privacy vulnerability affecting Apple iOS, iPadOS, and visionOS. An application installed on an affected device may bypass certain Privacy preferences and access data that should be restricted. Apple addressed the issue by removing sensitive data from the affected code path. The flaw requires local access and low privileges, and does not require user interaction. Apple resolved the issue in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27.
Critical Impact
A locally installed application can bypass Privacy preferences and read information that the user did not authorize the app to access.
Affected Products
- Apple iOS versions prior to 26.7 and prior to 27
- Apple iPadOS versions prior to 26.7 and prior to 27
- Apple visionOS versions prior to 27
Discovery Timeline
- 2026-09-14 - CVE-2026-86887 published to the National Vulnerability Database
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-86887
Vulnerability Analysis
CVE-2026-86887 is an information disclosure issue in Apple's Privacy preferences enforcement. The affected code path exposed sensitive data that should have been gated by user-controlled Privacy settings such as those managed through Transparency, Consent, and Control (TCC). An installed application could read that data without triggering the expected consent prompt or without being granted the corresponding entitlement.
The issue is limited to confidentiality. It does not allow modification of data or interruption of device availability. Exploitation requires code execution in the context of an installed app on the device, so remote unauthenticated exploitation is not in scope.
Root Cause
Apple's advisory states the fix was implemented by removing sensitive data from the affected interface. This pattern indicates that a system component was returning or caching information that should have been filtered by Privacy preferences before delivery to third-party apps. The vendor advisory does not enumerate the specific framework or API surface involved.
Attack Vector
An attacker distributes an application through normal channels or convinces a user to install it. Once running with standard app-level privileges, the app queries the affected system interface and receives data that Privacy preferences were meant to protect. No elevation of privilege, kernel exploit, or user interaction is required beyond initial installation and launch.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Apple Support Document #149034, Apple Support Document #149038, and Apple Support Document #149041 for vendor details.
Detection Methods for CVE-2026-86887
Indicators of Compromise
- No file-based or network-based indicators of compromise have been published for CVE-2026-86887.
- Presence of installed applications on devices running iOS, iPadOS, or visionOS versions prior to the fixed releases should be treated as exposure rather than compromise.
Detection Strategies
- Inventory managed Apple devices through Mobile Device Management (MDM) and flag those running iOS or iPadOS versions earlier than 26.7 or 27, or visionOS earlier than 27.
- Review installed third-party applications for unexpected access patterns to Privacy-gated data categories after the fixed OS versions are deployed.
- Correlate app behavior with MDM Privacy preferences profiles to identify applications requesting or accessing data outside their declared scope.
Monitoring Recommendations
- Enable MDM compliance reporting to alert when devices fall behind on Apple security updates.
- Track application installation events on managed devices and review apps sourced outside the enterprise catalog.
- Monitor Apple's security advisory feed for follow-up notes or additional CVEs referencing the same support documents.
How to Mitigate CVE-2026-86887
Immediate Actions Required
- Update affected devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, or visionOS 27 as applicable.
- Push the update through MDM to enforce installation on managed fleets and set a compliance deadline.
- Review installed applications on high-risk devices and remove any that are unnecessary or untrusted.
Patch Information
Apple resolved CVE-2026-86887 in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27. Installation guidance and full release notes are available in Apple Support Document #149034, Apple Support Document #149038, and Apple Support Document #149041.
Workarounds
- No vendor-supplied workaround exists. Applying the Apple security update is the only remediation.
- Restrict application installation to vetted apps distributed through the App Store or an approved enterprise catalog until patching is complete.
- Use MDM Privacy preferences profiles to constrain third-party app access to sensitive data categories where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
