An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

What fixes it

• 27iOS and iPadOSCVE List
• 27tvOSCVE List
• 27visionOSCVE List
• 27watchOSCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

1. 14 Sep 2026, 20:50 UTCPublishedCVE List
2. 27 Oct 2026, 11:20 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

• speedyfriend433/CVE-2026-84636-PoC: Proof of concept of CVE-2026-84636, WiFi SSID Info DisclosureGitHub proof-of-concept repositories, 27 Oct 2026Exploit code

Affected versions 4

• iOS and iPadOSaffected: all versions before 27CVE List
• tvOSaffected: all versions before 27CVE List
• visionOSaffected: all versions before 27CVE List
• watchOSaffected: all versions before 27CVE List

References 4

• support.apple.com/en-us/149034Referencevia CVE List
• support.apple.com/en-us/149036Referencevia CVE List
• support.apple.com/en-us/149037Referencevia CVE List
• support.apple.com/en-us/149038Referencevia CVE List