Apple Intelligence missing entitlement authorization allowing remote sensitive data access

#!/bin/bash
# CVE-2026-86987 Verification Script
# Checks whether a connected iOS/iPadOS device is patched
# Target: Apple Intelligence-capable devices (iPhone 15 Pro+, eligible iPads)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

FIXED_VERSION="27.2"
CVE_ID="CVE-2026-86987"
COMPONENT="Apple Intelligence"

# Apple Intelligence-capable device identifiers (partial list)
AI_MODELS="iPhone15,3|iPhone15,4|iPhone16|iPhone17|iPad13,4|iPad13,5|iPad13,6|iPad13,7|iPad14|iPad15|iPad16"

version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

echo "=== $CVE_ID Check ($COMPONENT) ==="
echo ""

if ! command -v ideviceinfo &>/dev/null; then
  echo "[!] ideviceinfo not found. Install: brew install libimobiledevice"
  echo ""
  echo "For MDM fleet checks, query your MDM for:"
  echo "  Model IN (iPhone 15 Pro+, eligible iPads) AND OS < $FIXED_VERSION"
  echo ""
  echo "UNKNOWN - tooling not available"
  exit 2
fi

PRODUCT_VERSION=$(ideviceinfo -k ProductVersion 2>/dev/null)
PRODUCT_TYPE=$(ideviceinfo -k ProductType 2>/dev/null)
DEVICE_NAME=$(ideviceinfo -k DeviceName 2>/dev/null)

if [ -z "$PRODUCT_VERSION" ]; then
  echo "UNKNOWN - No device connected or ideviceinfo failed"
  exit 2
fi

echo "Device:  $DEVICE_NAME ($PRODUCT_TYPE)"
echo "OS:      $PRODUCT_VERSION"
echo "Fixed:   >= $FIXED_VERSION"
echo ""

# Check if device supports Apple Intelligence
if echo "$PRODUCT_TYPE" | grep -qE "$AI_MODELS"; then
  echo "[*] Device model supports Apple Intelligence"
else
  echo "[*] Device model may NOT support Apple Intelligence"
  echo "    If Apple Intelligence is not available, device is NOT AFFECTED"
  echo ""
  echo "PATCHED - device not eligible for Apple Intelligence"
  exit 0
fi

echo ""
if version_gte "$PRODUCT_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED - running $PRODUCT_VERSION (>= $FIXED_VERSION)"
  exit 0
else
  echo "VULNERABLE - running $PRODUCT_VERSION (< $FIXED_VERSION)"
  echo "  Action: Update to iOS/iPadOS $FIXED_VERSION or later"
  echo "  Workaround: Disable Apple Intelligence via MDM profile"
  exit 1
fi