‹ Back to list

CVE-2026-86872

Status: Awaiting AnalysisMedium (5.4)—
Severity5.4Medium · CVSS 3.1
Exploitation probability0.16 %higher than 5% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.

CVSS

Base score
5.4
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.16 %
Percentile among all scored CVEs
5
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

UI:R exige que la víctima procese contenido web malicioso: ejecución en cliente (T1203). El texto solo cita comportamiento inesperado, sin comandos ni impacto concreto, así que no se asigna T1059.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Application Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (3)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apple — SafariAIApple — VisionosAIApple — WatchosAI

CWEs

References

Show 3 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-86872",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86872",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-20T15:12:57.460534Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "Apple",
          "product": "Safari",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "visionOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "watchOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T01:17:25.357",
  "references": [
    {
      "url": "https://support.apple.com/en-us/149037",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149038",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149039",
      "source": "product-security@apple.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior."
    }
  ],
  "lastModified": "2026-10-20T16:17:15.347",
  "sourceIdentifier": "product-security@apple.com"
}