Certificate Validation Issue in Apple Software Products
CVE-2026-86881
What is CVE-2026-86881?
A vulnerability affecting various Apple products has been identified, relating to a flaw in certificate validation procedures. This issue, linked to compromised intermediate certificate authorities, allows attackers to potentially issue certificates with arbitrary extended key usages, undermining the integrity of secure communications. Apple has addressed this vulnerability in updates for iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Users are encouraged to update their devices promptly to mitigate the risks associated with this vulnerability.
Affected Version(s)
iOS and iPadOS 0 < 26.7
iOS and iPadOS 0 < 27
macOS 0 < 15.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.