Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
25332 vulnerabilities by apple
CVE-2026-65388 (GCVE-0-2026-65388)
Vulnerability from nvd – Published: 2026-09-16 22:24 – Updated: 2026-09-17 13:05
VLAI
EPSS
VEX
Summary
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:05 UTC
CWE
- A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host.
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | containerization |
Affected:
0 , < 0.41.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:05:32.107756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:05:53.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "containerization",
"vendor": "Apple",
"versions": [
{
"lessThan": "0.41.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote attacker who controls a container registry may be able to direct a client\u0027s token request to a host of the attacker\u0027s choice, and disclose the victim\u0027s registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A remote attacker who controls a container registry may be able to direct a client\u0027s token request to a host of the attacker\u0027s choice, and disclose the victim\u0027s registry credentials to that host.",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T22:24:20.049Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-65388",
"datePublished": "2026-09-16T22:24:20.049Z",
"dateReserved": "2026-07-22T00:46:44.572Z",
"dateUpdated": "2026-09-17T13:05:53.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86924 (GCVE-0-2026-86924)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-16 17:33
VLAI
EPSS
VEX
Summary
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:33 UTC
CWE
- Connecting a malicious accessory may cause unexpected system termination
- CWE-20 - Improper Input Validation
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | macOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:33:06.194482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:33:08.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Connecting a malicious accessory may cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:46.818Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149041"
},
{
"url": "https://support.apple.com/en-us/149042"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86924",
"datePublished": "2026-09-14T20:50:46.818Z",
"dateReserved": "2026-09-08T16:43:41.878Z",
"dateUpdated": "2026-09-16T17:33:08.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86917 (GCVE-0-2026-86917)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-15 03:56
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 00:00 UTC
CWE
- An app may be able to gain root privileges
- CWE-280 - Improper Handling of Insufficient Permissions or Privileges
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-280",
"description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T03:56:27.247Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to gain root privileges",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:34.270Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86917",
"datePublished": "2026-09-14T20:49:34.270Z",
"dateReserved": "2026-09-08T16:43:41.876Z",
"dateUpdated": "2026-09-15T03:56:27.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86911 (GCVE-0-2026-86911)
Vulnerability from nvd – Published: 2026-09-14 20:48 – Updated: 2026-09-16 13:53
VLAI
EPSS
VEX
Summary
This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:52 UTC
CWE
- A malicious app may be able to bypass clickjacking protections for secure prompts
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:52:56.354489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:53:28.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious app may be able to bypass clickjacking protections for secure prompts",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:00.714Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86911",
"datePublished": "2026-09-14T20:48:00.714Z",
"dateReserved": "2026-09-08T16:43:41.875Z",
"dateUpdated": "2026-09-16T13:53:28.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86910 (GCVE-0-2026-86910)
Vulnerability from nvd – Published: 2026-09-14 20:47 – Updated: 2026-09-16 12:05
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 12:02 UTC
CWE
- An application may be able to access restricted files
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T12:02:27.511657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T12:05:49.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An application may be able to access restricted files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:47:30.203Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86910",
"datePublished": "2026-09-14T20:47:30.203Z",
"dateReserved": "2026-09-08T16:43:41.875Z",
"dateUpdated": "2026-09-16T12:05:49.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86909 (GCVE-0-2026-86909)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-17 14:13
VLAI
EPSS
VEX
Summary
A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:12 UTC
CWE
- An app may be able to bypass Gatekeeper checks
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:12:58.982499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:13:03.077Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to bypass Gatekeeper checks",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:50.569Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86909",
"datePublished": "2026-09-14T20:51:50.569Z",
"dateReserved": "2026-09-08T16:43:41.874Z",
"dateUpdated": "2026-09-17T14:13:03.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86905 (GCVE-0-2026-86905)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 14:30
VLAI
EPSS
VEX
Summary
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 14:30 UTC
CWE
- An app may be able to delete credentials stored in Keychain
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86905",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T14:30:17.746613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:30:20.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to delete credentials stored in Keychain",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:26.556Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86905",
"datePublished": "2026-09-14T20:51:26.556Z",
"dateReserved": "2026-09-08T16:43:41.874Z",
"dateUpdated": "2026-09-15T14:30:20.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86904 (GCVE-0-2026-86904)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 18:16
VLAI
EPSS
VEX
Summary
A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:16 UTC
CWE
- An app may be able to track users across apps and websites without permission
- CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | watchOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86904",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:16:21.178495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-359",
"description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:16:41.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to track users across apps and websites without permission",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:21.722Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86904",
"datePublished": "2026-09-14T20:51:21.722Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-15T18:16:41.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86903 (GCVE-0-2026-86903)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-15 15:22
VLAI
EPSS
VEX
Summary
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:22 UTC
CWE
- An app may be able to disclose kernel memory
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86903",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:22:26.009169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:22:29.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to disclose kernel memory",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:31.612Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86903",
"datePublished": "2026-09-14T20:50:31.612Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-15T15:22:29.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86902 (GCVE-0-2026-86902)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-17 15:06
VLAI
EPSS
VEX
Summary
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:06 UTC
CWE
- An app may be able to access sensitive user data
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86902",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:06:23.968127Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:06:26.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "14.8.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access sensitive user data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:56.907Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/128072"
},
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86902",
"datePublished": "2026-09-14T20:49:56.907Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-17T15:06:26.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86901 (GCVE-0-2026-86901)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-17 16:13
VLAI
EPSS
VEX
Summary
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:13 UTC
CWE
- Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86901",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:13:16.711448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:13:19.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:38.245Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86901",
"datePublished": "2026-09-14T20:49:38.245Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-17T16:13:19.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86900 (GCVE-0-2026-86900)
Vulnerability from nvd – Published: 2026-09-14 20:48 – Updated: 2026-09-17 15:37
VLAI
EPSS
VEX
Summary
An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:37 UTC
CWE
- Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86900",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:37:07.148842Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:37:10.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:24.001Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86900",
"datePublished": "2026-09-14T20:48:24.001Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-17T15:37:10.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86898 (GCVE-0-2026-86898)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-17 15:56
VLAI
EPSS
VEX
Summary
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:56 UTC
CWE
- Opening a maliciously crafted webarchive file may lead to universal cross-site scripting
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86898",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:56:23.950479Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:56:27.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Opening a maliciously crafted webarchive file may lead to universal cross-site scripting",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:52.675Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149039"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86898",
"datePublished": "2026-09-14T20:50:52.675Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-17T15:56:27.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86897 (GCVE-0-2026-86897)
Vulnerability from nvd – Published: 2026-09-14 20:47 – Updated: 2026-09-16 13:20
VLAI
EPSS
VEX
Summary
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:20 UTC
CWE
- An app may be able to access sensitive user data
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86897",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:20:46.007692Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:20:50.732Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access sensitive user data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:47:54.746Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149039"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86897",
"datePublished": "2026-09-14T20:47:54.746Z",
"dateReserved": "2026-09-08T16:43:41.873Z",
"dateUpdated": "2026-09-16T13:20:50.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86895 (GCVE-0-2026-86895)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 18:15
VLAI
EPSS
VEX
Summary
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:15 UTC
CWE
- A local app may be able to read a persistent account identifier
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:15:09.423450Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:15:36.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A local app may be able to read a persistent account identifier",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:36.216Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86895",
"datePublished": "2026-09-14T20:51:36.216Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-15T18:15:36.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86894 (GCVE-0-2026-86894)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 18:25
VLAI
EPSS
VEX
Summary
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:24 UTC
CWE
- An app may be able to break out of its sandbox
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T18:24:45.751327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:25:27.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to break out of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:11.982Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86894",
"datePublished": "2026-09-14T20:51:11.982Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-15T18:25:27.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86893 (GCVE-0-2026-86893)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-17 16:55
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:55 UTC
CWE
- An app may be able to read device name
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T16:55:04.689321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T16:55:09.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to read device name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to read device name",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:39.900Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86893",
"datePublished": "2026-09-14T20:50:39.900Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-17T16:55:09.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86892 (GCVE-0-2026-86892)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-17 14:34
VLAI
EPSS
VEX
Summary
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:34 UTC
CWE
- An app may be able to cause a denial-of-service
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | visionOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86892",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:34:43.110875Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:34:46.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to cause a denial-of-service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:48.092Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86892",
"datePublished": "2026-09-14T20:49:48.092Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-17T14:34:46.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86891 (GCVE-0-2026-86891)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-17 14:45
VLAI
EPSS
VEX
Summary
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:45 UTC
CWE
- An app may be able to access Bluetooth device information
- CWE-285 - Improper Authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86891",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:45:08.374606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:45:21.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access Bluetooth device information",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:27.231Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86891",
"datePublished": "2026-09-14T20:49:27.231Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-17T14:45:21.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86890 (GCVE-0-2026-86890)
Vulnerability from nvd – Published: 2026-09-14 20:48 – Updated: 2026-09-16 15:21
VLAI
EPSS
VEX
Summary
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:20 UTC
CWE
- An attacker with physical access to a locked device may be able to view sensitive user information
- CWE-287 - Improper Authentication
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:20:54.853057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:21:10.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker with physical access to a locked device may be able to view sensitive user information",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:30.087Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86890",
"datePublished": "2026-09-14T20:48:30.087Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-16T15:21:10.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86889 (GCVE-0-2026-86889)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-15 15:23
VLAI
EPSS
VEX
Summary
A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:23 UTC
CWE
- An attacker in a privileged network position may be able to intercept network traffic
- CWE-295 - Improper Certificate Validation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86889",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:23:35.770442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:23:39.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker in a privileged network position may be able to intercept network traffic",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:30.682Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86889",
"datePublished": "2026-09-14T20:50:30.682Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-15T15:23:39.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86888 (GCVE-0-2026-86888)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-20 00:03
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:09 UTC
CWE
- A local app may be able to read a persistent account identifier
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:09:20.491785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:03:51.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A local app may be able to read a persistent account identifier",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:00.787Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149042"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86888",
"datePublished": "2026-09-14T20:50:00.787Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-20T00:03:51.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86887 (GCVE-0-2026-86887)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-20 00:04
VLAI
EPSS
VEX
Summary
A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:43 UTC
CWE
- An app may be able to bypass certain Privacy preferences
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | visionOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:43:41.010788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:04:01.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to bypass certain Privacy preferences",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:17.456Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86887",
"datePublished": "2026-09-14T20:49:17.456Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-20T00:04:01.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86886 (GCVE-0-2026-86886)
Vulnerability from nvd – Published: 2026-09-14 20:48 – Updated: 2026-09-17 15:38
VLAI
EPSS
VEX
Summary
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:38 UTC
CWE
- An app may be able to modify protected system files
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | watchOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86886",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:38:22.958531Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:38:26.054Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to modify protected system files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:48:40.053Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149041"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86886",
"datePublished": "2026-09-14T20:48:40.053Z",
"dateReserved": "2026-09-08T16:43:41.872Z",
"dateUpdated": "2026-09-17T15:38:26.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86885 (GCVE-0-2026-86885)
Vulnerability from nvd – Published: 2026-09-14 20:50 – Updated: 2026-09-15 15:27
VLAI
EPSS
VEX
Summary
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:27 UTC
CWE
- An attacker in radio range may be able to cause unexpected system termination
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86885",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:27:15.516900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:27:18.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker in radio range may be able to cause unexpected system termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:50:45.891Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86885",
"datePublished": "2026-09-14T20:50:45.891Z",
"dateReserved": "2026-09-08T16:43:41.871Z",
"dateUpdated": "2026-09-15T15:27:18.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86884 (GCVE-0-2026-86884)
Vulnerability from nvd – Published: 2026-09-14 20:49 – Updated: 2026-09-17 14:50
VLAI
EPSS
VEX
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:50 UTC
CWE
- An app may be able to access sensitive user data
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:50:08.504536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:50:11.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access sensitive user data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:49:41.384Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86884",
"datePublished": "2026-09-14T20:49:41.384Z",
"dateReserved": "2026-09-08T16:43:41.871Z",
"dateUpdated": "2026-09-17T14:50:11.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86883 (GCVE-0-2026-86883)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 17:54
VLAI
EPSS
VEX
Summary
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 17:52 UTC
CWE
- An app may be able to access sensitive user data
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 27
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86883",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T17:52:41.150809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T17:54:59.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access sensitive user data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:45.531Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149038"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86883",
"datePublished": "2026-09-14T20:51:45.531Z",
"dateReserved": "2026-09-08T16:43:41.871Z",
"dateUpdated": "2026-09-15T17:54:59.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86882 (GCVE-0-2026-86882)
Vulnerability from nvd – Published: 2026-09-14 20:51 – Updated: 2026-09-15 15:06
VLAI
EPSS
VEX
Summary
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 15:05 UTC
CWE
- Processing a maliciously crafted image may lead to unexpected process termination
- CWE-787 - Out-of-bounds Write
Assigner
References
8 references
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 26.7
(custom)
Affected: 0 , < 27 (custom) |
|
| Apple | macOS |
Affected:
0 , < 15.8
(custom)
Affected: 0 , < 26.7 (custom) Affected: 0 , < 27 (custom) |
|
| Apple | tvOS |
Affected:
0 , < 27
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 27
(custom)
|
|
| Apple | watchOS |
Affected:
0 , < 27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86882",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T15:05:59.829427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T15:06:04.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "26.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "watchOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "27",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Processing a maliciously crafted image may lead to unexpected process termination",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:51:07.153Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/149034"
},
{
"url": "https://support.apple.com/en-us/149035"
},
{
"url": "https://support.apple.com/en-us/149036"
},
{
"url": "https://support.apple.com/en-us/149037"
},
{
"url": "https://support.apple.com/en-us/149038"
},
{
"url": "https://support.apple.com/en-us/149041"
},
{
"url": "https://support.apple.com/en-us/149042"
},
{
"url": "https://support.apple.com/en-us/149043"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-86882",
"datePublished": "2026-09-14T20:51:07.153Z",
"dateReserved": "2026-09-08T16:43:41.871Z",
"dateUpdated": "2026-09-15T15:06:04.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65388 (GCVE-0-2026-65388)
Vulnerability from cvelistv5 – Published: 2026-09-16 22:24 – Updated: 2026-09-17 13:05
VLAI
EPSS
VEX
Summary
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 13:05 UTC
CWE
- A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host.
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | containerization |
Affected:
0 , < 0.41.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-65388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T13:05:32.107756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:05:53.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "containerization",
"vendor": "Apple",
"versions": [
{
"lessThan": "0.41.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote attacker who controls a container registry may be able to direct a client\u0027s token request to a host of the attacker\u0027s choice, and disclose the victim\u0027s registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A remote attacker who controls a container registry may be able to direct a client\u0027s token request to a host of the attacker\u0027s choice, and disclose the victim\u0027s registry credentials to that host.",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T22:24:20.049Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2026-65388",
"datePublished": "2026-09-16T22:24:20.049Z",
"dateReserved": "2026-07-22T00:46:44.572Z",
"dateUpdated": "2026-09-17T13:05:53.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1172
Vulnerability from certfr_avis - Published: 2026-09-15 - Updated: 2026-09-15
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | iOS | iOS versions antérieures à 27 | ||
| Apple | macOS | macOS Tahoe versions antérieures à 26.7 | ||
| Apple | Safari | Safari versions antérieures à 27 | ||
| Apple | Xcode | Xcode versions antérieures à 27 | ||
| Apple | macOS | macOS Golden Gate versions antérieures à 27 | ||
| Apple | iOS | iOS versions antérieures à 26.7 | ||
| Apple | iPadOS | iPadOS versions antérieures à 26.7 | ||
| Apple | tvOS | tvOS versions antérieures à 27 | ||
| Apple | iPadOS | iPadOS versions antérieures à 27 | ||
| Apple | visionOS | visionOS versions antérieures à 26.6.1 | ||
| Apple | visionOS | visionOS versions antérieures à 27 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.8 | ||
| Apple | watchOS | watchOS versions antérieures à 27 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "iOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Tahoe versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Safari versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "Safari",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Xcode versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "Xcode",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Golden Gate versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 26.7",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "tvOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "tvOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iPadOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "iPadOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 26.6.1",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "visionOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.8",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS versions ant\u00e9rieures \u00e0 27",
"product": {
"name": "watchOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-86886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86886"
},
{
"name": "CVE-2026-86885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86885"
},
{
"name": "CVE-2026-65362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65362"
},
{
"name": "CVE-2026-28930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28930"
},
{
"name": "CVE-2026-86879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86879"
},
{
"name": "CVE-2026-43697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43697"
},
{
"name": "CVE-2026-65391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65391"
},
{
"name": "CVE-2026-84566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84566"
},
{
"name": "CVE-2026-84572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84572"
},
{
"name": "CVE-2026-43664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43664"
},
{
"name": "CVE-2026-84558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84558"
},
{
"name": "CVE-2026-84553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84553"
},
{
"name": "CVE-2026-84626",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84626"
},
{
"name": "CVE-2026-84549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84549"
},
{
"name": "CVE-2026-64788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64788"
},
{
"name": "CVE-2026-65337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65337"
},
{
"name": "CVE-2026-84527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84527"
},
{
"name": "CVE-2026-84487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84487"
},
{
"name": "CVE-2026-86890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86890"
},
{
"name": "CVE-2026-84556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84556"
},
{
"name": "CVE-2026-84489",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84489"
},
{
"name": "CVE-2026-84520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84520"
},
{
"name": "CVE-2026-65331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65331"
},
{
"name": "CVE-2026-65352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65352"
},
{
"name": "CVE-2026-43695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43695"
},
{
"name": "CVE-2026-43738",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43738"
},
{
"name": "CVE-2026-84621",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84621"
},
{
"name": "CVE-2026-84517",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84517"
},
{
"name": "CVE-2026-84585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84585"
},
{
"name": "CVE-2026-84522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84522"
},
{
"name": "CVE-2026-86887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86887"
},
{
"name": "CVE-2026-65381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65381"
},
{
"name": "CVE-2026-43791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43791"
},
{
"name": "CVE-2026-86905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86905"
},
{
"name": "CVE-2026-84565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84565"
},
{
"name": "CVE-2026-86902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86902"
},
{
"name": "CVE-2026-84580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84580"
},
{
"name": "CVE-2026-84559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84559"
},
{
"name": "CVE-2026-65332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65332"
},
{
"name": "CVE-2026-84491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84491"
},
{
"name": "CVE-2026-65413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65413"
},
{
"name": "CVE-2026-84615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84615"
},
{
"name": "CVE-2026-43661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43661"
},
{
"name": "CVE-2026-64760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64760"
},
{
"name": "CVE-2026-65406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65406"
},
{
"name": "CVE-2026-84611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84611"
},
{
"name": "CVE-2026-64712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64712"
},
{
"name": "CVE-2026-65365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65365"
},
{
"name": "CVE-2026-65343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65343"
},
{
"name": "CVE-2026-84630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84630"
},
{
"name": "CVE-2026-84551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84551"
},
{
"name": "CVE-2026-65400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65400"
},
{
"name": "CVE-2026-43696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43696"
},
{
"name": "CVE-2026-84635",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84635"
},
{
"name": "CVE-2026-84540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84540"
},
{
"name": "CVE-2026-65364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65364"
},
{
"name": "CVE-2026-65340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65340"
},
{
"name": "CVE-2026-84538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84538"
},
{
"name": "CVE-2026-64790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64790"
},
{
"name": "CVE-2026-64761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64761"
},
{
"name": "CVE-2026-43698",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43698"
},
{
"name": "CVE-2026-65399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65399"
},
{
"name": "CVE-2026-84550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84550"
},
{
"name": "CVE-2026-86895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86895"
},
{
"name": "CVE-2026-65412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65412"
},
{
"name": "CVE-2026-20683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-20683"
},
{
"name": "CVE-2026-86876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86876"
},
{
"name": "CVE-2022-3437",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3437"
},
{
"name": "CVE-2026-43763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43763"
},
{
"name": "CVE-2026-84506",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84506"
},
{
"name": "CVE-2026-84512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84512"
},
{
"name": "CVE-2026-84631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84631"
},
{
"name": "CVE-2026-84544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84544"
},
{
"name": "CVE-2026-65344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65344"
},
{
"name": "CVE-2026-43691",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43691"
},
{
"name": "CVE-2026-64753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64753"
},
{
"name": "CVE-2026-65360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65360"
},
{
"name": "CVE-2026-64752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64752"
},
{
"name": "CVE-2026-84620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84620"
},
{
"name": "CVE-2026-84543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84543"
},
{
"name": "CVE-2026-84629",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84629"
},
{
"name": "CVE-2026-84541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84541"
},
{
"name": "CVE-2026-84505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84505"
},
{
"name": "CVE-2026-64781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64781"
},
{
"name": "CVE-2026-84623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84623"
},
{
"name": "CVE-2026-84619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84619"
},
{
"name": "CVE-2026-84513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84513"
},
{
"name": "CVE-2026-84534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84534"
},
{
"name": "CVE-2026-86888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86888"
},
{
"name": "CVE-2026-84531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84531"
},
{
"name": "CVE-2026-65345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65345"
},
{
"name": "CVE-2026-84625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84625"
},
{
"name": "CVE-2026-84497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84497"
},
{
"name": "CVE-2026-84554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84554"
},
{
"name": "CVE-2026-64787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64787"
},
{
"name": "CVE-2026-65339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65339"
},
{
"name": "CVE-2026-86897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86897"
},
{
"name": "CVE-2026-86884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86884"
},
{
"name": "CVE-2026-84596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84596"
},
{
"name": "CVE-2026-86911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86911"
},
{
"name": "CVE-2026-43674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43674"
},
{
"name": "CVE-2026-84532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84532"
},
{
"name": "CVE-2026-28935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28935"
},
{
"name": "CVE-2026-64718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64718"
},
{
"name": "CVE-2026-84600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84600"
},
{
"name": "CVE-2026-43737",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43737"
},
{
"name": "CVE-2026-84524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84524"
},
{
"name": "CVE-2026-86904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86904"
},
{
"name": "CVE-2026-86894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86894"
},
{
"name": "CVE-2026-28969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28969"
},
{
"name": "CVE-2026-65395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65395"
},
{
"name": "CVE-2026-84593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84593"
},
{
"name": "CVE-2026-84597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84597"
},
{
"name": "CVE-2026-84530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84530"
},
{
"name": "CVE-2026-84533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84533"
},
{
"name": "CVE-2026-65351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65351"
},
{
"name": "CVE-2026-84576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84576"
},
{
"name": "CVE-2026-28966",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28966"
},
{
"name": "CVE-2026-84568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84568"
},
{
"name": "CVE-2026-84616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84616"
},
{
"name": "CVE-2026-84581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84581"
},
{
"name": "CVE-2026-64779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64779"
},
{
"name": "CVE-2026-65341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65341"
},
{
"name": "CVE-2026-84589",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84589"
},
{
"name": "CVE-2026-86882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86882"
},
{
"name": "CVE-2026-65377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65377"
},
{
"name": "CVE-2026-65410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65410"
},
{
"name": "CVE-2026-84516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84516"
},
{
"name": "CVE-2026-43683",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43683"
},
{
"name": "CVE-2026-86917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86917"
},
{
"name": "CVE-2026-43677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43677"
},
{
"name": "CVE-2026-65404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65404"
},
{
"name": "CVE-2026-43787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43787"
},
{
"name": "CVE-2026-84518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84518"
},
{
"name": "CVE-2026-43790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43790"
},
{
"name": "CVE-2026-84617",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84617"
},
{
"name": "CVE-2026-65334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65334"
},
{
"name": "CVE-2026-84563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84563"
},
{
"name": "CVE-2026-43689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43689"
},
{
"name": "CVE-2026-84521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84521"
},
{
"name": "CVE-2026-65414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65414"
},
{
"name": "CVE-2026-84612",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84612"
},
{
"name": "CVE-2026-84515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84515"
},
{
"name": "CVE-2026-64782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64782"
},
{
"name": "CVE-2026-84537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84537"
},
{
"name": "CVE-2026-84525",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84525"
},
{
"name": "CVE-2026-84523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84523"
},
{
"name": "CVE-2026-28934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28934"
},
{
"name": "CVE-2026-84574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84574"
},
{
"name": "CVE-2026-86889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86889"
},
{
"name": "CVE-2026-65346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65346"
},
{
"name": "CVE-2026-34979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34979"
},
{
"name": "CVE-2026-64778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64778"
},
{
"name": "CVE-2026-84601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84601"
},
{
"name": "CVE-2026-65329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65329"
},
{
"name": "CVE-2026-84555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84555"
},
{
"name": "CVE-2026-64780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64780"
},
{
"name": "CVE-2026-84514",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84514"
},
{
"name": "CVE-2026-65378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65378"
},
{
"name": "CVE-2026-86878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86878"
},
{
"name": "CVE-2026-86924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86924"
},
{
"name": "CVE-2026-86869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86869"
},
{
"name": "CVE-2026-65354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65354"
},
{
"name": "CVE-2026-65405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65405"
},
{
"name": "CVE-2026-84492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84492"
},
{
"name": "CVE-2026-84586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84586"
},
{
"name": "CVE-2026-43684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43684"
},
{
"name": "CVE-2026-84583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84583"
},
{
"name": "CVE-2026-84598",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84598"
},
{
"name": "CVE-2026-65393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65393"
},
{
"name": "CVE-2026-43688",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43688"
},
{
"name": "CVE-2026-84571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84571"
},
{
"name": "CVE-2026-43786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43786"
},
{
"name": "CVE-2026-84546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84546"
},
{
"name": "CVE-2026-86910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86910"
},
{
"name": "CVE-2026-64714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64714"
},
{
"name": "CVE-2026-43719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43719"
},
{
"name": "CVE-2026-84606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84606"
},
{
"name": "CVE-2026-86901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86901"
},
{
"name": "CVE-2026-86881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86881"
},
{
"name": "CVE-2026-43687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43687"
},
{
"name": "CVE-2026-86903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86903"
},
{
"name": "CVE-2026-65361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65361"
},
{
"name": "CVE-2026-84577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84577"
},
{
"name": "CVE-2026-84622",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84622"
},
{
"name": "CVE-2026-64758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64758"
},
{
"name": "CVE-2026-65376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65376"
},
{
"name": "CVE-2026-84588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84588"
},
{
"name": "CVE-2026-65349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65349"
},
{
"name": "CVE-2026-86870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86870"
},
{
"name": "CVE-2026-65390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65390"
},
{
"name": "CVE-2026-86900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86900"
},
{
"name": "CVE-2026-43686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43686"
},
{
"name": "CVE-2026-84636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84636"
},
{
"name": "CVE-2026-84587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84587"
},
{
"name": "CVE-2026-65380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65380"
},
{
"name": "CVE-2026-43794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43794"
},
{
"name": "CVE-2026-84548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84548"
},
{
"name": "CVE-2026-65348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65348"
},
{
"name": "CVE-2026-65355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65355"
},
{
"name": "CVE-2026-65409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65409"
},
{
"name": "CVE-2026-65403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65403"
},
{
"name": "CVE-2026-65369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65369"
},
{
"name": "CVE-2026-65382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65382"
},
{
"name": "CVE-2026-84578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84578"
},
{
"name": "CVE-2026-86891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86891"
},
{
"name": "CVE-2026-84569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84569"
},
{
"name": "CVE-2026-43702",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43702"
},
{
"name": "CVE-2026-84624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84624"
},
{
"name": "CVE-2026-84609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84609"
},
{
"name": "CVE-2026-28937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28937"
},
{
"name": "CVE-2026-84507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84507"
},
{
"name": "CVE-2026-28899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28899"
},
{
"name": "CVE-2026-84575",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84575"
},
{
"name": "CVE-2026-84560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84560"
},
{
"name": "CVE-2026-43743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43743"
},
{
"name": "CVE-2026-65336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65336"
},
{
"name": "CVE-2026-43692",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43692"
},
{
"name": "CVE-2026-43785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43785"
},
{
"name": "CVE-2026-43741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43741"
},
{
"name": "CVE-2026-84519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84519"
},
{
"name": "CVE-2026-64784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64784"
},
{
"name": "CVE-2026-84552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84552"
},
{
"name": "CVE-2026-86892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86892"
},
{
"name": "CVE-2026-64715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64715"
},
{
"name": "CVE-2026-65371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65371"
},
{
"name": "CVE-2026-65402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65402"
},
{
"name": "CVE-2026-84509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84509"
},
{
"name": "CVE-2026-28968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28968"
},
{
"name": "CVE-2026-65347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65347"
},
{
"name": "CVE-2026-86893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86893"
},
{
"name": "CVE-2026-43795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43795"
},
{
"name": "CVE-2026-84618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84618"
},
{
"name": "CVE-2026-86909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86909"
},
{
"name": "CVE-2026-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43788"
},
{
"name": "CVE-2026-86883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86883"
},
{
"name": "CVE-2026-84567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84567"
},
{
"name": "CVE-2026-65415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65415"
},
{
"name": "CVE-2026-65383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65383"
},
{
"name": "CVE-2026-84511",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84511"
},
{
"name": "CVE-2026-84628",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84628"
},
{
"name": "CVE-2026-84602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84602"
},
{
"name": "CVE-2026-65411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65411"
},
{
"name": "CVE-2026-84535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84535"
},
{
"name": "CVE-2026-84561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84561"
},
{
"name": "CVE-2026-65335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65335"
},
{
"name": "CVE-2026-84584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84584"
},
{
"name": "CVE-2026-84573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84573"
},
{
"name": "CVE-2026-84570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84570"
},
{
"name": "CVE-2026-84632",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84632"
},
{
"name": "CVE-2026-84526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84526"
},
{
"name": "CVE-2026-65333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65333"
},
{
"name": "CVE-2026-43789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43789"
},
{
"name": "CVE-2026-84607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84607"
},
{
"name": "CVE-2026-65408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65408"
},
{
"name": "CVE-2026-84536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84536"
},
{
"name": "CVE-2026-64736",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64736"
},
{
"name": "CVE-2026-43715",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43715"
},
{
"name": "CVE-2026-84564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84564"
},
{
"name": "CVE-2026-43690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43690"
},
{
"name": "CVE-2026-65342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65342"
},
{
"name": "CVE-2026-65359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65359"
},
{
"name": "CVE-2026-43760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43760"
},
{
"name": "CVE-2026-84510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84510"
},
{
"name": "CVE-2026-65358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65358"
},
{
"name": "CVE-2026-65374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65374"
},
{
"name": "CVE-2026-65398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65398"
},
{
"name": "CVE-2026-65338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65338"
},
{
"name": "CVE-2026-84603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84603"
},
{
"name": "CVE-2026-65401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65401"
},
{
"name": "CVE-2026-64756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64756"
},
{
"name": "CVE-2026-65330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65330"
},
{
"name": "CVE-2026-65407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65407"
},
{
"name": "CVE-2026-86898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86898"
},
{
"name": "CVE-2026-65375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65375"
}
],
"initial_release_date": "2026-09-15T00:00:00",
"last_revision_date": "2026-09-15T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1172",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149036",
"url": "https://support.apple.com/en-us/149036"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149041",
"url": "https://support.apple.com/en-us/149041"
},
{
"published_at": "2026-08-17",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 148353",
"url": "https://support.apple.com/en-us/148353"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149035",
"url": "https://support.apple.com/en-us/149035"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149034",
"url": "https://support.apple.com/en-us/149034"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149042",
"url": "https://support.apple.com/en-us/149042"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149039",
"url": "https://support.apple.com/en-us/149039"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149038",
"url": "https://support.apple.com/en-us/149038"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149040",
"url": "https://support.apple.com/en-us/149040"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149043",
"url": "https://support.apple.com/en-us/149043"
},
{
"published_at": "2026-09-14",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 149037",
"url": "https://support.apple.com/en-us/149037"
}
]
}