An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
CVE-2026-86989
CVSS base score
5.1 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-287
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
apple ipados
apple iphone os
References
- support.apple.com Release Notes, Vendor Advisory
- support.apple.com Release Notes, Vendor Advisory