CVE-2026-86921: Apple iOS vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker must have local access to the affected device. The available information does not indicate that the issue can be exploited remotely.

Q: Which systems should be updated?

Update devices running affected Apple operating systems to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27, as applicable.

Q: What could successful exploitation allow?

A local attacker may be able to overwrite files that should be restricted by permissions.

Published Oct 20, 2026

Updated

A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.

Affected Software

4 affected components

Apple iOS<26.7, <27

Apple iPadOS<26.7, <27

Apple macOS Golden Gate<27

Apple visionOS<27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apple iOS/iPadOS to a version that resolves this vulnerability.
Fixed in 26.7
Upgrade
Upgrade Apple iOS/iPadOS to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade Apple macOS Golden Gate to a version that resolves this vulnerability.
Fixed in 27
Upgrade
Upgrade Apple visionOS to a version that resolves this vulnerability.
Fixed in 27

Event History

Oct 20, 2026

CVE Published

via MITRE·12:50 AM

Data Sourced

via MITRE·12:50 AM

DescriptionWeakness

Data Sourced

via NVD·01:17 AM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must have local access to the affected device. The available information does not indicate that the issue can be exploited remotely.

Which systems should be updated?