Improper certificate validation in macOS - CVE-2026-86881
Published: September 15, 2026
Vulnerability identifier: #VU149860
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86881
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper certificate validation in Security component. A remote attacker with a compromised intermediate certificate authority can issue certificates with arbitrary extended key usages.
Affected software
macOS
Apple iOS
iPadOS
tvOS
watchOS
visionOS
Apple iOS
iPadOS
tvOS
watchOS
visionOS
How to mitigate CVE-2026-86881
Install updates from vendor's website.
macOS - addressed in versions 26.7 25G229, 15.8 24H23, 27.0 26A428
Apple iOS - addressed in versions 26.7 23H24, 27.0 24A427, 27.0 24A437
iPadOS - addressed in versions 26.7 23H24, 27.0 24A437
tvOS - update to 27.0 24J361
watchOS - update to 27.0 24R364
visionOS - update to 27.0
Apple iOS - addressed in versions 26.7 23H24, 27.0 24A427, 27.0 24A437
iPadOS - addressed in versions 26.7 23H24, 27.0 24A437
tvOS - update to 27.0 24J361
watchOS - update to 27.0 24R364
visionOS - update to 27.0
External References
Related Security Bulletins
- Multiple vulnerabilities in macOS Tahoe
- Multiple vulnerabilities in macOS Sequoia
- Multiple vulnerabilities in macOS
- Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
- Multiple vulnerabilities in Apple iOS 27 and iPadOS 27
- Multiple vulnerabilities in Apple visionOS
- Multiple vulnerabilities in Apple watchOS
- Multiple vulnerabilities in Apple tvOS