Apple iOS, iPadOS and macOS: Sandbox escape due to race condition
Summary
A race condition in iOS, iPadOS and macOS allows a malicious app to break out of its sandbox. The CVE record rates the issue at CVSS 7.8 (High), with a local attack vector and low privileges required. Apple fixed the issue in iOS 27, iPadOS 27 and macOS Golden Gate 27; the advisory text retrieved does not show the CVE ID next to the entry, so the affected component could not be confirmed.
Affected
- iOS and iPadOS before 27 (per CVE record)
- macOS before 27 (per CVE record)
- Exact build numbers: Unknown.
Fixed in
- iOS 27 and iPadOS 27 (Apple advisory 149034, released September 14, 2026)
- macOS Golden Gate 27 (Apple advisory 149035)
- Whether 26.7 backports fix this CVE: Unknown.
Workaround
- Unknown. The CVE record lists no workaround.
- Interim measure (not vendor guidance): allow only App Store app installation and restrict unmanaged apps via MDM until devices are updated.
Exploitation
- No known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no.
- Not in the CISA KEV catalog.
- No public proof of concept found.
Our recommendation
- Update iPhones, iPads and Macs that support iOS, iPadOS or macOS 27 to the latest 27.x release.
- Check Apple's advisory to confirm the entry for this CVE.
- Track devices still on 26.x and verify whether Apple's 26.7 backport covers this CVE.
- Enforce App Store-only app installation and review app permissions via MDM.
- Recheck NVD and CISA, as the NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apple Security Content of iOS 27 and iPadOS 27 support.apple.com
- Apple Security Content of macOS Golden Gate 27 support.apple.com
- OpenCVE CVE-2026-86961 app.opencve.io
- VulDB CVE-2026-86961 vuldb.com
- CVE Threatint CVE-2026-86961 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:35.
Original description (NVD)
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.