CVE-2026-86895
published 2026-09-14CVE-2026-86895: An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.47%
39.4th percentile
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | tvos | < 27 | 27 |
| apple | tvos | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iPadOS/iOS/tvOS/visionOS/watchOS up to 26 information disclosure
vuldb·2026-09-15
CVE-2026-86895 [LOW] Apple iPadOS/iOS/tvOS/visionOS/watchOS up to 26 information disclosure
A vulnerability was found in Apple iPadOS, iOS, tvOS, visionOS and watchOS up to 26. It has been rated as problematic. This vulnerability affects unknown code. The manipulation leads to information disclosure.
This vulnerability is listed as CVE-2026-86895. The attack must be carried out locally. There is no available exploit.
Upgrading the affected component is advised.
GHSA
An information disclosure issue was addressed with improved state management.
ghsa_unreviewed·2026-09-14
CVE-2026-86895 [HIGH] CWE-200 An information disclosure issue was addressed with improved state management.
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier.
No detection rules found.
No public exploits indexed.
2026-09-14
Published