CVE-2026-86872
published 2026-10-20CVE-2026-86872: A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web…
PriorityP428medium5.4CVSS 3.1
AVNACLPRNUIRSUCLINAL
EPSS
0.27%
17.4th percentile
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | < 27 | 27 |
| apple | visionos | < 27 | 27 |
| apple | watchos | < 27 | 27 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A logic issue was addressed with improved state management.
ghsa_unreviewed·2026-10-20
CVE-2026-86872 [MEDIUM] CWE-843 A logic issue was addressed with improved state management.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
VulDB
Apple Safari/visionOS/watchOS up to 26 state issue
vuldb·2026-10-20
CVE-2026-86872 [CRITICAL] Apple Safari/visionOS/watchOS up to 26 state issue
A vulnerability was found in Apple Safari, visionOS and watchOS up to 26. It has been declared as critical. Affected by this issue is some unknown functionality. The manipulation results in state issue.
This vulnerability is known as CVE-2026-86872. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-20
Published