CVE-2026-86957

Status: Awaiting AnalysisMedium (6.5)—

Severity6.5Medium · CVSS 3.1

Exploitation probability0.16 %higher than 5% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination.

CVSS

Base score: 6.5
Version: 3.1
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.16 %
Percentile among all scored CVEs: 5
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1499 Endpoint Denial of Serviceimpact85 %

El vector CVSS es AV:A/PR:N/UI:N (red adyacente sin privilegios) y la descripción indica que un atacante en proximidad inalámbrica puede causar la terminación del sistema.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Filter Network Traffic Disable or Remove Feature or Program

Affected technologies (6)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apple — Ipados^AI Apple — Iphone OS^AI Apple — Macos^AI Apple — Tvos^AI Apple — Visionos^AI Apple — Watchos^AI

CWEs

CWE-125

References

Show 8 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-86957",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86957",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-20T10:23:10.431694Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "Apple",
          "product": "iOS and iPadOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "macOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "15.8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "26.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "tvOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "visionOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Apple",
          "product": "watchOS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "27",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T01:17:28.660",
  "references": [
    {
      "url": "https://support.apple.com/en-us/149034",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149035",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149036",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149037",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149038",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149041",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149042",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/149043",
      "source": "product-security@apple.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in wireless proximity may be able to cause unexpected system termination."
    }
  ],
  "lastModified": "2026-10-20T15:03:59.857",
  "sourceIdentifier": "product-security@apple.com"
}