CVE-2026-86886

MediumCVSS 5.5

Published: 14/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A path traversal issue was found in Apple systems and fixed with improved input validation. An app may be able to modify protected system files.

Risk Assessment

An app may modify protected system files, potentially leading to system corruption or privilege escalation.

Recommendation

Update iOS/iPadOS 26.7, iOS/iPadOS 27, and watchOS 27 to versions containing the input validation fix.

Other vulnerabilities in Apple iOS/iPadOS/watchOS

CVE-2021-1879MediumActively exploited
This issue was addressed by improved management of object lifetimes. The issue is fixed in iOS 12.5.2, iOS 14.4.2, iPadOS 14.4.2, and watchOS 7.3.3, and processing maliciously crafted web content may lead to universal cross-site scripting. Apple is aware of a report that this issue may have been actively exploited.

Original NVD description (English source)

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files.