4.4 Medium

CVE-2026-84493 An authentication issue was addressed with improved state management

Description

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitable with local access to the machine, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Privileges required: Low
Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
iOS and iPadOS 27.2	earliest → < 27.2	27.2
iOS and iPadOS 26.7	earliest → < 26.7.2	26.7.2

References

support.apple.com support.apple.com
support.apple.com support.apple.com

Timeline

Published October 26, 2026
Last modified November 4, 2026

The 2049 CVEs of iOS and iPadOS →

CVE-2026-86925 An authorization issue was addressed with improved state management 5.5 Medium CVE-2026-84627 A buffer overflow was addressed with improved bounds checking 7.8 High CVE-2026-86972 A buffer overflow was addressed with improved size validation 7.8 High CVE-2026-113912 An out-of-bounds access issue was addressed with improved bounds checking 7.1 High

Track this CVE