CVE-2026-86990: 
macOS vulnerability analysis and mitigation

CVE-2026-86990 is an access control vulnerability in Apple's CoreMedia framework that allows a malicious app to access the device camera without user permission. It was disclosed and patched on October 26, 2026, affecting iOS and iPadOS (before 18.7.11, 26.7.2, and 27.2), macOS Tahoe (before 26.7.2), macOS Golden Gate (before 27.2), and visionOS (before 27.2). The vulnerability was discovered by Mustafa Calap (@ordinal0, dbg.re) and is estimated to be of Medium severity; a formal CVSS score had not been assigned at time of publication (Apple Advisory iOS 18.7.11, Apple Advisory iOS 26.7.2, Apple Advisory iOS 27.2).

The vulnerability resides in Apple's CoreMedia framework and is classified as an improper access control issue (CWE-284), addressed by Apple with improved access restrictions. A malicious app installed on an affected device can bypass the operating system's camera permission model, gaining unauthorized access to the camera hardware without triggering the standard user permission prompt. Exploitation requires a malicious app to be installed and executed on the target device; no network access or user interaction beyond app installation is needed. No public technical write-up or proof-of-concept code has been identified (Apple Advisory iOS 18.7.11, Apple Advisory macOS Golden Gate 27.2).

Successful exploitation allows a malicious app to silently capture video or images via the device camera without the user's knowledge or consent, constituting a significant privacy violation. The impact is primarily a confidentiality breach — sensitive visual information from the user's environment can be exfiltrated without any visible indicator or permission dialog. The vulnerability does not directly enable code execution, privilege escalation, or lateral movement, but unauthorized camera access could be leveraged for surveillance or social engineering in targeted attacks (Apple Advisory iOS 26.7.2, Apple Advisory macOS Tahoe 26.7.2).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is reported as 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a malicious app to be installed on the target device, limiting the attack surface to scenarios where a user installs an untrusted application (Feedly Intelligence).

Apple has released patches across all affected platforms: update to iOS 18.7.11 or iPadOS 18.7.11, iOS 26.7.2 or iPadOS 26.7.2, iOS 27.2 or iPadOS 27.2, macOS Tahoe 26.7.2, macOS Golden Gate 27.2, or visionOS 27.2. No configuration-based workaround is available; upgrading to a patched version is the only recommended remediation. Enterprise administrators should also review installed applications, remove apps from untrusted sources, and consider enforcing Mobile Device Management (MDM) policies to restrict app installations (Apple Advisory iOS 18.7.11, Apple Advisory macOS Tahoe 26.7.2, Apple Advisory macOS Golden Gate 27.2).

The October 26, 2026 Apple update was notable for addressing at least 329 unique security vulnerabilities across multiple platforms, drawing broad coverage from technology media outlets such as 9to5Mac and The Daily Tech Feed. The SANS Internet Storm Center published a diary entry summarizing the Apple patches for October 2026. No specific researcher commentary or significant social media discussion focused exclusively on CVE-2026-86990 was identified beyond standard vulnerability tracking and aggregation sites (9to5Mac, SANS ISC).