CVE-2026-86886
published 2026-09-14CVE-2026-86886: A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCNIHAN
EPSS
0.17%
5.9th percentile
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 26.7 | 26.7 |
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 26.7 | 26.7 |
| apple | iphone_os | < 26.7 | 26.7 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/watchOS prior 26.7/27 path traversal
vuldb·2026-09-15
CVE-2026-86886 Apple iOS/iPadOS/watchOS prior 26.7/27 path traversal
A vulnerability was found in Apple iOS, iPadOS and watchOS. It has been declared as very critical. Affected is an unknown function. Such manipulation leads to path traversal.
This vulnerability is listed as CVE-2026-86886. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
A path traversal issue was addressed with improved input validation.
ghsa_unreviewed·2026-09-14
CVE-2026-86886 A path traversal issue was addressed with improved input validation.
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.
No detection rules found.
No public exploits indexed.
2026-09-14
Published