CVE-2026-86898
published 2026-09-14CVE-2026-86898: A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening…
PriorityP426medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.20%
9.1th percentile
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | macos | < 27 | 27 |
| apple | macos | < 27.0 | 27.0 |
| apple | safari | < 27 | 27 |
| apple | safari | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS/Safari/visionOS up to 26 State Management cross site scripting
vuldb·2026-09-15
CVE-2026-86898 [LOW] Apple iOS/iPadOS/macOS/Safari/visionOS up to 26 State Management cross site scripting
A vulnerability was found in Apple iOS, iPadOS, macOS, Safari and visionOS up to 26 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component State Management. Such manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2026-86898. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
A logic issue was addressed with improved state management.
ghsa_unreviewed·2026-09-14
CVE-2026-86898 A logic issue was addressed with improved state management.
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.
No detection rules found.
No public exploits indexed.
2026-09-14
Published