CVE-2026-113963

Think of this like a lock on a filing cabinet that a sneaky employee could jiggle open without the right key. A rogue app installed on your device could exploit this weakness to peek at sensitive personal data it normally shouldn't be able to see. It only works if that bad app is already on the device — it can't be done remotely by a stranger.

This matters to you if your business uses iPhones, iPads, Apple Vision Pro, or Apple Watches for work. The risk only applies if a malicious app is installed on the device in the first place — it's not something an outside attacker can trigger over the internet.

There is no evidence this is being actively exploited, and no public exploit code exists for it, so this is a low-urgency, routine update rather than an emergency. Apply the fix during your normal device update cycle without disrupting operations.

Confirm device exposure by checking the OS version under Settings > General > About on each device; any device below 27.2.1 for iOS, visionOS, or watchOS is affected. The fix is to upgrade to version 27.2.1 or later on all platforms — this is a standard OS update with no known breaking changes for typical business use. There is no workaround since the flaw is a local authorization logic issue inside the OS; sideloading restrictions and App Store vetting reduce practical risk until updated. No CISA KEV listing exists, so there is no mandated remediation deadline. Monitor Apple's security advisories for any supplemental updates and ensure MDM (mobile device management) policies enforce minimum OS versions going forward.

CVSS 3.1 score is 5.5 (Medium), vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N — local attack vector requiring low privileges, no user interaction, high confidentiality impact only. Weakness is CWE-863 (Incorrect Authorization) due to improper state management. Not listed in CISA KEV, no public exploit code, and EPSS places predicted exploitation likelihood in the lowest percentile with a flat trend. Exploit maturity is theoretical; press attention is newly emerging but reflects disclosure coverage, not confirmed in-the-wild activity. Fixed in iOS 27.2.1, visionOS 27.2.1, and watchOS 27.2.1.