medium · CVSS v3 6.2 · EPSS 0.00146

CVE-2026-86921

CVE-2026-86921 is a permissions issue in Apple operating systems that could allow a local attacker to overwrite restricted files. The flaw w

Overview

CVE-2026-86921 is a permissions issue in Apple operating systems that could allow a local attacker to overwrite restricted files. The flaw was fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Description

A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.

Impact

Confidentiality: potential data leakage if attacker writes to sensitive files. Integrity: attacker can modify system or application files, undermining trust. Availability: not directly affected. Defenders: local users and administrators on affected Apple devices.

Remediation

Update to the latest OS releases (iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, visionOS 27). If unable to update immediately, restrict local user privileges and enforce file system integrity checks.

Risk context

The CVSS score of 6.2 indicates medium risk, and the EPSS of 0.00146 suggests a very low likelihood of exploitation in the wild. Defenders should monitor for updates but the urgency is moderate.

Affected products

  • iOS 26.7
  • iOS 27
  • iPadOS 26.7
  • iPadOS 27
  • macOS Golden Gate 27
  • visionOS 27

Scores

Severity
medium
CVSS v2
4.9
CVSS v3
6.2
CVSS v4
—
EPSS
0.00146

permissions local attacker file overwrite Apple OS iOS macOS

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

View analysis

medium

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

View analysis

medium

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

View analysis