Is CVE-2026-86897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86897 being exploited in the wild.

How severe is CVE-2026-86897?

Medium severity, with a CVSS score of 5.5, published 14 September 2026.

Which products and versions are affected?

Apple iPadOS prior to 27; Apple macOS prior to Golden Gate 27; Apple Safari prior to 27; Apple Visionos prior to 27.

Is there a fix for CVE-2026-86897?

A patch was published on 2026-09-14: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, Safari 27, and visionOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86897 attacked?

It is attacked with local access.

Am I affected by CVE-2026-86897?

Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86897: Apple Accessibility entitlement check bypass in iOS and macOS

CVE-2026-86897 · Severity: medium · CVSS 5.5 · Published 2026-09-14

An iOS and macOS app can bypass entitlement checks in Apple's Accessibility framework to gain unauthorized access to sensitive user data without permission. This could allow a malicious application to read private information that users expect to be protected, such as health data, communication history, or financial information, potentially compromising user privacy and trust.

Technologies: Apple iPadOS, Apple Iphone Os, Apple macOS, Apple Safari, Apple Visionos. Vendors: Apple.

Quick answers

Is CVE-2026-86897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86897 being exploited in the wild.
How severe is CVE-2026-86897?: Medium severity, with a CVSS score of 5.5, published 14 September 2026.
Which products and versions are affected?: Apple iPadOS prior to 27; Apple macOS prior to Golden Gate 27; Apple Safari prior to 27; Apple Visionos prior to 27.
Is there a fix for CVE-2026-86897?: A patch was published on 2026-09-14: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, Safari 27, and visionOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86897 attacked?: It is attacked with local access.
Am I affected by CVE-2026-86897?: Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the Accessibility framework affecting iOS and macOS systems. An app with local execution privileges can circumvent entitlement checks that are designed to restrict access to sensitive user data. The root cause stems from insufficient validation of application entitlements before allowing access to protected information. The attack vector is local (requires an app already installed on the device), and no user interaction is needed once the malicious app is running. An attacker can read sensitive personal data intended to be protected. The fix involves additional entitlement checks deployed via OS updates (iOS 27, iPadOS 27, macOS Golden Gate 27, and Safari 27).

Affected products

Apple iOS prior to 27
Apple iPadOS prior to 27
Apple macOS prior to Golden Gate 27
Apple Safari prior to 27
Apple visionOS prior to 27

Timeline

2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, Safari 27, and visionOS 27
2026-09-14: advisory: CVE-2026-86897 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.