CVE-2026-86905

Executive Summary

CVE-2026-86905 is an improper access control weakness (CWE-284) in Apple's iOS, iPadOS, macOS Golden Gate, and visionOS platforms that allows a locally executing application to delete credentials stored in the user's Keychain. The vulnerability requires local access and low privileges to trigger, with no user interaction, resulting in high integrity impact but no direct confidentiality or availability impact. Apple states the issue was addressed by removing the vulnerable code, with fixes available in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.

Technical Analysis

The vulnerability is classified as CWE-284, Improper Access Control. The NVD description explicitly states that "this issue was addressed by removing the vulnerable code" and that "an app may be able to delete credentials stored in Keychain." This indicates a flaw in the entitlement, sandbox, or access-control checks that normally enforce which applications may perform destructive operations against the Keychain credential store.

The attack surface is the local Keychain service API. Because the report states that "an app" can trigger the impact — and not a remote attacker — the flaw is best understood as a missing or incorrectly enforced authorization check on a Keychain mutation operation (specifically credential deletion). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N confirms:

• Local attack vector (AV:L)
• Low attack complexity (AC:L)
• Low privileges required (PR:L)
• No user interaction (UI:N)
• Scope unchanged (S:U)
• No confidentiality impact (C:N)
• High integrity impact (I:H)
• No availability impact (A:N)

The high integrity subscore reflects that credential store contents can be tampered with (deleted), undermining trust in stored secrets. The absence of confidentiality impact indicates the flaw does not expose credential material to the attacker — it permits destruction, not exfiltration. The scope-unchanged rating means the impact is confined to the security authority of the vulnerable component (the credential store), rather than propagating to other components.

No public PoC, exploit code, or Nuclei template is available, and EPSS is 0.00099 (0.9% percentile), indicating very low predicted exploitation activity at the time of reporting. CISA KEV status is NO.

Because the NVD description is sparse, no specific function names, class names, API paths, or parameter names can be reliably attributed. The vulnerability mechanism is therefore described at the vulnerability-class level: improper access control permitting an overly broad set of local applications to invoke a Keychain deletion operation.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper access control / credential store tampering) and the constraints stated in the NVD description.

1. Reconnaissance/target identification. An attacker with the ability to install or run a local application on a targeted iOS, iPadOS, macOS Golden Gate, or visionOS 27-predecessor device identifies a device with a populated Keychain (typical of any user device with saved Wi-Fi, website, or app credentials).

2. Triggering the flaw class. The attacker's application — operating with low privileges (PR:L) and requiring no user interaction (UI:N) — invokes the Keychain credential deletion operation. The improper access control (CWE-284) condition means the application is not properly prevented from performing this destructive operation, despite lacking the authorization that should be required.

3. Payload/execution method. At the vulnerability-class level, the payload is a local API call or sequence of calls that deletes one or more Keychain items. No specific function names, API symbols, or entitlement identifiers are provided in the NVD data, so no specific invocation pattern can be stated.

4. Post-exploitation impact. The deletion of Keychain credentials causes loss of stored secrets on the affected device, forcing re-authentication and potentially disrupting dependent services that rely on those credentials. The attacker gains no credential confidentiality (C:N), but the integrity of the credential store is destroyed (I:H). Because deletion is not traditionally reversible, the impact is best characterized as destructive credential tampering.

The attack does not cross a scope boundary (S:U), and availability of the underlying OS is not affected (A:N).

Impact Assessment

CVE-2026-86905 affects Apple's flagship operating systems: iOS/iPadOS, macOS "Golden Gate," and visionOS. The blast radius is any managed or unmanaged device running a version prior to the fixed releases (iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27).

Business impact centers on integrity of the credential store. Because the CVSS integrity subscore is High (I:H), an attacker able to run a local application can destroy stored credentials — potentially forcing organization-wide re-enrollment, credential rotation, or service disruption for users whose Keychain-stored secrets are deleted. The absence of confidentiality impact (C:N) means this is not a credential-theft vulnerability; it is a credential-destruction vulnerability. Availability impact is None (A:N), so the operating system itself remains functional.

The local attack vector (AV:L) and low privileges required (PR:L) mean exploitation requires a foothold: the attacker must already be able to execute code on the target device (for example through a malicious app). This substantially limits remote exploitation but makes the flaw valuable as a secondary or disruptive payload in multi-stage attacks. With no user interaction required (UI:N), a malicious application can perform the deletion silently.

EPSS of 0.00099 places this CVE in the 0.9% percentile of exploited CVEs — extremely low predicted exploitation. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and no public PoC. Enterprises should weigh the risk primarily as a potential disruptive technique rather than an active threat.

Detection Guidance

Sigma Rule

title: Local Application Keychain Credential Deletion Attempt
id: 7f4b2c9e-1d3a-4b6e-9c2f-8a5d1e7b3f90
status: experimental
description: Detects local process behavior consistent with unauthorized Keychain credential deletion (CVE-2026-86905) on Apple platforms.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-86905
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: macos
detection:
  selection_process:
    Image|endswith:
      - '/security'
      - '/securityd'
  selection_cmd:
    CommandLine|contains:
      - 'delete-generic-password'
      - 'delete-internet-password'
      - 'delete-keychain'
  condition: selection_process and selection_cmd
falsepositives:
  - Legitimate administrative credential cleanup scripts
  - User-initiated keychain resets
level: medium
tags:
  - attack.t1555
  - attack.credential_access
  - cve.2026.86905

YARA Rule

rule CVE_2026_86905_Keychain_Delete_Access_Control
{
    meta:
        description = "Heuristic detection of binaries invoking Keychain credential deletion on Apple platforms (CVE-2026-86905)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-86905"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $kc1 = "SecItemDelete" ascii
        $kc2 = "SecKeychainItemDelete" ascii
        $kc3 = "delete-generic-password" ascii
        $kc4 = "kSecClassGenericPassword" ascii
        $kc5 = "kSecClassInternetPassword" ascii

    condition:
        uint32be(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE or
        (2 of ($kc*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-86905 Possible Keychain Credential Deletion Activity (Apple)"; flow:to_server,established; content:"SecItemDelete"; nocase; classtype:attempted-user; reference:cve,2026-86905; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-86905; sid:202686905; rev:1;)

Note: This vulnerability is local and does not inherently generate network traffic. The Suricata rule above is a best-effort network-correlated indicator and should be treated as low-fidelity; endpoint telemetry is the primary detection surface.

Elastic Detection

process where host.os.type == "macos" and event.type == "start" and
  process.name in ("security", "securityd") and
  process.args : ("delete-generic-password", "delete-internet-password", "delete-keychain")

Splunk SPL Query

index=endpoint (process_name="security" OR process_name="securityd")
| search process_command_line IN ("*delete-generic-password*", "*delete-internet-password*", "*delete-keychain*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, process_command_line
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="apple,keychain,cve-2026-86905,">
  <rule id="100905" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">security|securityd</field>
    <field name="command_line">delete-generic-password|delete-internet-password|delete-keychain</field>
    <description>CVE-2026-86905: Possible unauthorized Keychain credential deletion activity detected</description>
    <mitre>
      <id>T1555</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations. Until patched, reduce the ability of untrusted applications to execute locally on affected devices. Enforce application allowlisting or mobile device management policies that prevent sideloading of unvetted apps on iOS/iPadOS and macOS. Restrict local code execution on visionOS devices where applicable. Monitor for unexpected Keychain deletion events using the detection guidance above, and maintain independent backups of critical credentials where feasible.

2. Patch/upgrade steps. Upgrade to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27. Apple stated the fix was implemented by removing the vulnerable code. Because patch confidence is CLAIMED (single source, NVD) and not independently confirmed, verify the fix status in Apple's official security advisory and release notes before relying on the update.

3. Long-term hardening. Adopt a defense-in-depth posture for credential stores: minimize the number of applications granted Keychain access; audit application entitlements; implement EDR with process-level monitoring on macOS and mobile fleet telemetry; and maintain credential recovery procedures so that credential destruction events do not cause durable business outage.

References

• NVD — CVE-2026-86905: https://nvd.nist.gov/vuln/detail/CVE-2026-86905
• Apple Product Security Advisories: https://support.apple.com/en-us/HT201222
• MITRE ATT&CK T1555 — Credentials from Password Stores: https://attack.mitre.org/techniques/T1555/
• CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: None identified. CISA KEV status is NO, EPSS is 0.00099, and no public PoC or exploit code is available.