CVE-2026-86881: Apple iOS, iPadOS, and macOS certificate validation bypass

CVE-2026-86881 · Severity: critical · CVSS 9.1 · Published 2026-09-14

Apple's operating systems use certificate validation to ensure secure communication between devices and servers. A flaw in this validation allows an attacker with a compromised intermediate certificate authority to issue fraudulent certificates with arbitrary permissions, enabling man-in-the-middle attacks and unauthorized access to sensitive communications. This affects iPhones, iPads, Mac computers, Apple Watches, and other Apple devices.

Technologies: Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia, Apple Tvos, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2026-86881 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86881 being exploited in the wild.
How severe is CVE-2026-86881?
Critical severity, with a CVSS score of 9.1, published 14 September 2026.
Which products and versions are affected?
Apple iPadOS before 27, before 26.7; Apple macOS Golden Gate before 27; Apple macOS Sequoia before 15.8; Apple macOS Tahoe before 26.7; and 3 more.
Is there a fix for CVE-2026-86881?
A patch was published on 2026-09-14: Patches released for all affected platforms Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86881 attacked?
It is attacked over the network.
Am I affected by CVE-2026-86881?
Check whether you run Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A certificate validation vulnerability exists in Apple's certificate handling logic affecting multiple operating systems. The issue allows an attacker who has compromised an intermediate certificate authority to issue certificates with arbitrary extended key usages, bypassing normal certificate validation controls. This is a critical flaw because extended key usage (EKU) extensions are meant to restrict what purposes a certificate can be used for; arbitrary EKUs enable unauthorized use cases. The vulnerability is present across iOS/iPadOS, macOS, tvOS, visionOS, and watchOS platforms. Patches were released on September 14, 2026 across all affected platforms through their latest major and minor versions.

Affected products

  • Apple iOS before 27, before 26.7
  • Apple iPadOS before 27, before 26.7
  • Apple macOS Golden Gate before 27
  • Apple macOS Sequoia before 15.8
  • Apple macOS Tahoe before 26.7
  • Apple tvOS before 27
  • Apple visionOS before 27
  • Apple watchOS before 27

Timeline

  • 2026-09-14: disclosed: Vulnerability details released with security updates
  • 2026-09-14: patched: Patches released for all affected platforms

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.