Is CVE-2026-86905 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86905 being exploited in the wild.

How severe is CVE-2026-86905?

Medium severity, with a CVSS score of 5.5, published 14 September 2026.

Which products and versions are affected?

Apple iPadOS 27 and later (fixed); Apple macOS Golden Gate 27 and later (fixed); Apple Visionos 27 and later (fixed).

Is there a fix for CVE-2026-86905?

A patch was published on 2026-09-14: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86905 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-86905?

Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86905: Apple Keychain unauthorized credential deletion vulnerability

CVE-2026-86905 · Severity: medium · CVSS 5.5 · Published 2026-09-14

Apple's Keychain is a secure storage system used across iOS, iPadOS, macOS, and visionOS to protect sensitive credentials and authentication data. A vulnerability allowed malicious apps to delete stored credentials without proper authorization, potentially exposing users to account takeover and loss of secure access to online services. Apple addressed this issue by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Technologies: Apple iPadOS, Apple Iphone Os, Apple macOS, Apple macOS Golden Gate, Apple Visionos. Vendors: Apple.

Quick answers

Is CVE-2026-86905 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86905 being exploited in the wild.
How severe is CVE-2026-86905?: Medium severity, with a CVSS score of 5.5, published 14 September 2026.
Which products and versions are affected?: Apple iPadOS 27 and later (fixed); Apple macOS Golden Gate 27 and later (fixed); Apple Visionos 27 and later (fixed).
Is there a fix for CVE-2026-86905?: A patch was published on 2026-09-14: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86905 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-86905?: Check whether you run Apple iPadOS, Apple Iphone Os, Apple macOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability affects the Keychain system component across multiple Apple platforms (iOS, iPadOS, macOS, and visionOS). The issue allowed an installed application to delete credentials stored in Keychain without proper authorization checks. The attack vector is local—requiring installation of a malicious app on the device—and does not require elevated privileges or user interaction beyond installing the compromised app. An attacker exploiting this could delete or corrupt stored passwords, authentication tokens, and certificates, disrupting the victim's ability to access secured accounts and services. Apple's fix involved removing the vulnerable code path entirely rather than patching it.

Affected products

Apple iOS 27 and later (fixed)
Apple iPadOS 27 and later (fixed)
Apple macOS Golden Gate 27 and later (fixed)
Apple visionOS 27 and later (fixed)

Timeline

2026-09-14: disclosed
2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.