{"metadata": {"vulnerability": "CVE-2026-86990", "count": 27, "kinds": {"milestone": 8, "sighting": 5, "kev": 0, "other": 14}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0455", "record": "NCSC-2026-0455", "field": "document.tracking.generator.date"}, {"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0456", "record": "NCSC-2026-0456", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-08T16:43:47.664Z", "date_only": false, "value": "2026-09-08T16:43:47.664Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": true, "value": "2026-10-26", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1387", "record": "CERTFR-2026-AVI-1387", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-26T20:00:00Z", "date_only": false, "value": "2026-10-26T20:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20261027", "record": "CVE-2026-86990", "field": "creation_timestamp", "uuid": "c87625a7-2e98-4caa-96ce-2796d45c49fe", "url": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20261027"}, {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apple", "record": "CVE-2026-86990", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T21:20:37Z", "date_only": false, "value": "2026-10-26T21:20:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7C2X-HQ8C-9V32", "record": "GHSA-7C2X-HQ8C-9V32", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-26T21:20:37.897Z", "date_only": false, "value": "2026-10-26T21:20:37.897", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86990", "record": "FKIE_CVE-2026-86990", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T21:36:29Z", "date_only": false, "value": "2026-10-26T21:36:29Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7C2X-HQ8C-9V32", "record": "GHSA-7C2X-HQ8C-9V32", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-26T21:36:29Z", "date_only": false, "value": "2026-10-26T21:36:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7C2X-HQ8C-9V32", "record": "GHSA-7C2X-HQ8C-9V32", "field": "modified"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1387", "record": "CERTFR-2026-AVI-1387", "field": "last_revision_date"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1387", "record": "CERTFR-2026-AVI-1387", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1387", "record": "CERTFR-2026-AVI-1387", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-27T00:22:36.999Z", "date_only": false, "value": "2026-10-27T00:22:36.999436Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117510016629938399", "record": "CVE-2026-86990", "field": "creation_timestamp", "uuid": "4a5516b5-32b2-4ef9-8cd7-c572e0964f91", "content": "CVE-2026-86990  An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.\nhttps://www.cve.org/CVERecord?id=CVE-2026-86990https://support.apple.com/en-us/149225https://support.apple.com/en-us/149227https://support.apple.com/en-us/149230https://support.apple.com/en-us/149521https://support.apple.com/en-us/149522https://support.apple.com/en-us/149526#Apple #iOSandiPadOS #macOS #visionOS#CVE_2026_86990#bot", "url": "https://infosec.exchange/users/cve/statuses/117510016629938399"}, {"timestamp": "2026-10-27T08:05:01.630Z", "date_only": false, "value": "2026-10-27T08:05:01.630016Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0455", "record": "NCSC-2026-0455", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-27T08:05:01.630Z", "date_only": false, "value": "2026-10-27T08:05:01.630016Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0455", "record": "NCSC-2026-0455", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T08:05:28.446Z", "date_only": false, "value": "2026-10-27T08:05:28.446863Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0456", "record": "NCSC-2026-0456", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-27T08:05:28.446Z", "date_only": false, "value": "2026-10-27T08:05:28.446863Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0456", "record": "NCSC-2026-0456", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T08:05:28.446Z", "date_only": false, "value": "2026-10-27T08:05:28.446863Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0456", "record": "NCSC-2026-0456", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-27T08:11:54Z", "date_only": false, "value": "2026-10-27T08:11:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/10/27/apple-patches-for-october-mon.html", "record": "CVE-2026-86990", "field": "creation_timestamp", "uuid": "75f39f0a-a0fe-4cff-afa8-90acadf8d768", "content": "Apple Patches for October 2026, (Mon, Oct 26th)\n\nApple has released its October 2026 security updates, covering 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, according to the SANS Internet Storm Center. No new vulnerability in this release is marked as already exploited, but the update delivers iOS 18 patches for CVE-2026-86950, an already-exploited CoreGraphics flaw first patched a month ago; other notable fixes include CVE-2026-86990, which let a malicious app access the camera without permission, and CVE-2026-28864, which let a local attacker access a user’s Keychain items.", "url": "https://threatintel.cc/2026/10/27/apple-patches-for-october-mon.html"}, {"timestamp": "2026-10-27T09:12:12.457Z", "date_only": false, "value": "2026-10-27T09:12:12.457857Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117512099073886808", "record": "CVE-2026-86990", "field": "creation_timestamp", "uuid": "06206fd0-412e-4b2f-830b-9dc93f77bfad", "content": "Apple Patches for October 2026, (Mon, Oct 26th)\nApple has released its October 2026 security updates, covering 304 vulnerabilities across iOS, iPadOS, macOS, tvOS, watchOS, visionOS and Safari, according to the SANS Internet Storm Center. No new vulnerability in this release is marked as already exploited, but the update delivers iOS 18 patches for CVE-2026-86950, an already-exploited CoreGraphics flaw first patched a month ago; other notable fixes include CVE-2026-86990, which let a malicious app access the camera without permission, and CVE-2026-28864, which let a local attacker access a user\u2019s Keychain items. https://isc.sans.edu/diary/rss/33458", "url": "https://infosec.exchange/users/edwardk/statuses/117512099073886808"}, {"timestamp": "2026-10-27T14:52:57.863Z", "date_only": false, "value": "2026-10-27T14:52:57.863", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-86990", "record": "FKIE_CVE-2026-86990", "field": "lastModified"}, {"timestamp": "2026-10-27T21:22:45.051Z", "date_only": false, "value": "2026-10-27T21:22:45.051395Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3myv6a3q2qy2z", "record": "CVE-2026-86990", "field": "creation_timestamp", "uuid": "f458920f-9f8a-4ec0-b7b2-352de5a8a79d", "content": "CVE-2026-86990 is trending. Hype score 23, currently #6 on cvemon.\n\nAn access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-86990", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3myv6a3q2qy2z"}, {"timestamp": "2026-10-28T14:17:59.503Z", "date_only": false, "value": "2026-10-28T14:17:59.503789Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0455", "record": "NCSC-2026-0455", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-28T14:17:59.503Z", "date_only": false, "value": "2026-10-28T14:17:59.503789Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0455", "record": "NCSC-2026-0455", "field": "document.tracking.current_release_date"}], "metrics": {"as_of": "2026-10-29T14:07:08.586Z", "anchors": {"origin": {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 235480.282315, "hours": 65.41118953194444, "days": 2.725466230497685, "min_seconds": 235480.282315, "max_seconds": 235480.282315, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-26T20:42:28.304Z", "date_only": false, "value": "2026-10-26T20:42:28.304Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-86990", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T14:07:08.586Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}