01 · The Real Story
Someone left the camera door unlocked, but you still need a key to the building
CVE-2026-86990 is a CoreMedia TCC (Transparency, Consent, and Control) bypass on Apple platforms. The flaw lets a malicious application already running on the device silently activate the camera — and potentially suppress the green indicator dot — without ever triggering the user-consent prompt that Apple's privacy framework is supposed to enforce. Affected version spans are wide: every supported Apple OS branch prior to the October 26 2026 patches is vulnerable — iOS/iPadOS < 27.2, iOS/iPadOS < 26.7.2, iOS/iPadOS < 18.7.11, macOS Golden Gate < 27.2, macOS Tahoe < 26.7.2, and visionOS < 27.2.
Apple assigned no CVSS score. Third-party trackers label it HIGH, but that overstates the enterprise risk for managed fleets. The critical friction point is that the attacker must *already* have a malicious app executing on the target device. On iOS, Apple's App Store review, Gatekeeper, and notarization create significant friction; on macOS, sideloaded or social-engineered apps lower the bar. The bug is undeniably valuable for targeted surveillance and commercial spyware (this exact vulnerability class — TCC camera/mic bypass — is a staple of NSO Group's Pegasus and Intellexa's Predator toolchains), but for a fleet of 10,000 managed endpoints, it is not a remotely exploitable, wormable, or fleet-scale threat. It amplifies a *prior* compromise rather than enabling one.
"CoreMedia camera bypass needs a planted app first — spyware gold, fleet-management bronze."
02 · The Attack Path
3 steps from start to impact.
STEP 01
Malicious app delivery
The attacker must get a malicious application onto the target device. On iOS this typically means either an App Store submission that passes review, enterprise-certificate sideloading (requires a $299/yr Apple Developer Enterprise account), or exploitation of a separate code-execution bug. On macOS the bar is lower — the app can be distributed as a
.dmg via phishing, malvertising, or supply-chain compromise of a legitimate app.Conditions required:
- Target device runs an unpatched Apple OS
- Attacker can deliver and execute an app on the device
Where this breaks in practice:
- iOS App Store review catches overtly malicious camera access patterns
- Enterprise-managed devices with MDM restrict sideloading via
allowAppInstallation/allowEnterpriseAppTrustprofiles - macOS Gatekeeper and notarization provide a secondary gate, though users can click through
Detection/coverage: MDM compliance checks (e.g., Jamf, Kandji, Intune) flag unmanaged app installs; XProtect signatures for known malware families
STEP 02
CoreMedia TCC bypass trigger
The planted app calls into the CoreMedia framework's media-capture APIs. Due to the access-control flaw, the authorization check that should consult TCC's consent database (
/var/db/TCC/TCC.db on macOS, equivalent on iOS) is either skipped entirely or subject to a race condition, allowing the app to initialize a camera capture session without the user ever seeing a permission dialog.Conditions required:
- Malicious app is running with normal user-level privileges
- Unpatched CoreMedia framework present
Where this breaks in practice:
- Patched devices are immune — Apple shipped the fix across six OS branches simultaneously
- On managed fleets, automatic updates or MDM-enforced OS minimums close this window quickly
Detection/coverage: Endpoint telemetry (e.g., CrowdStrike Falcon for Mac, Microsoft Defender for Endpoint) can flag unexpected
AVCaptureSession starts from unsigned or low-reputation processes; unified logging (log stream --predicate 'subsystem == "com.apple.TCC"') shows grant/deny eventsSTEP 03
Silent camera capture
With the TCC check bypassed, the app can capture still images or video from the front or rear camera. On macOS and visionOS, the green indicator dot may or may not appear depending on the exact code path exploited. On iOS, indicator dot suppression historically requires kernel-level access (as demonstrated by Predator spyware), but this bug may allow partial suppression from userland. The captured media is then exfiltrated via standard network calls or stored locally for later retrieval.
Conditions required:
- Camera hardware is physically present and not covered
- Network connectivity for exfiltration (or local storage for later pickup)
Where this breaks in practice:
- Network-level DLP or firewall rules can block unexpected outbound connections from the app
- iOS sandboxing limits where captured media can be stored
- Little Snitch / LuLu on macOS can alert on unexpected outbound connections
Detection/coverage: Network monitoring for unusual data uploads from mobile devices; macOS
eslogger or Endpoint Security framework events for camera access03 · Compensating Control
1
MEDIUM 5.5→IGNORE 0.0
SEVERITY REDUCEDEnforce minimum OS version via MDM — Push an MDM compliance policy requiring iOS ≥ 27.2 / iPadOS ≥ 27.2 / macOS ≥ 27.2 (Golden Gate) or the equivalent backport branches (26.7.2, 18.7.11). Devices below this threshold should be flagged non-compliant and blocked from corporate resources (email, VPN, SSO). No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window per the noisgate remediation SLA, but given the trivial deployment cost of OS updates, aim for 30 days voluntarily.
2
MEDIUM 5.5→LOW 2.5
SEVERITY REDUCEDRestrict app installation on managed iOS devices — Use MDM configuration profiles to disable
allowAppInstallation for sideloaded apps and allowEnterpriseAppTrust for enterprise-signed apps not from your organization. This eliminates the primary delivery vector on iOS. On macOS, enforce --global-disable for Gatekeeper overrides via spctl and require notarization.3
MEDIUM 5.5→LOW 3.0
SEVERITY REDUCEDDeploy endpoint detection on macOS fleet — Ensure macOS endpoints run an EDR agent (CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne) that monitors
AVCaptureSession API calls and flags camera access from unsigned or low-reputation binaries. Configure alerting for unexpected TCC database modifications. This does not prevent exploitation but provides detection and response capability.4
MEDIUM 5.5→LOW 3.5
SEVERITY REDUCEDEnable Little Snitch or LuLu on high-value macOS endpoints — On executive or sensitive-environment Macs, deploy an application-layer firewall that alerts on unexpected outbound connections. This does not block camera access but disrupts the exfiltration step of the attack chain, limiting the attacker's ability to retrieve captured media in real time.
What doesn't work
- Network firewalls / NAC — This is a local OS-level vulnerability. Network-layer controls cannot prevent camera access; they can only partially disrupt exfiltration, and a patient attacker can store media locally for later retrieval.
- VPN or ZTNA — Zero-trust network access controls do not affect local app-to-hardware interactions. The camera bypass occurs entirely within the device's OS, independent of network policy.
- Disabling the camera in hardware — While physically covering the camera lens is effective, it is not scalable across a fleet of 10,000 mobile devices and does not address the software vulnerability itself.
04 · Intelligence Metadata
The supporting signals.
| In-the-wild exploitation | None observed. Not listed in CISA KEV. No reports from Google TAG, Amnesty Tech, or Citizen Lab as of 2026-10-27. |
|---|---|
| Proof-of-concept availability | No public PoC found. No repos on GitHub named after CVE-2026-86990. No entries on pocindex.io, ExploitDB, or Metasploit. The bug class (TCC bypass) is well-understood by researchers but this specific CoreMedia vector is not publicly documented. |
| EPSS score | ≈0.00 (just disclosed 2026-10-26; FIRST EPSS has not yet scored it meaningfully). Expect this to rise slightly once NVD publishes a vector, but local-access-required bugs rarely exceed the 10th percentile. |
| CISA KEV status | Not listed as of 2026-10-27. |
| CVSS vector (estimated) | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N — 5.5. Local attack vector, low complexity, no privileges beyond app execution, user interaction required (installing the app), high confidentiality impact (camera access), no integrity or availability impact. |
| Affected versions | iOS/iPadOS < 27.2, < 26.7.2, < 18.7.11; macOS Golden Gate < 27.2; macOS Tahoe < 26.7.2; visionOS < 27.2. Essentially all supported Apple OS branches. |
| Fixed versions | iOS 27.2, iPadOS 27.2, iOS 26.7.2, iPadOS 26.7.2, iOS 18.7.11, iPadOS 18.7.11, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2 — all released 2026-10-26. |
| Scanning / exposure | Not applicable for internet-facing scanning (Shodan/GreyNoise/Censys). This is an OS-level local vulnerability on endpoints. MDM compliance dashboards (Jamf, Kandji, Intune, Workspace ONE) are the relevant detection surface — query for devices below the patched OS version. |
| Disclosure & credit | Disclosed 2026-10-26 by Mustafa Calap (@ordinal0, dbg.re). Apple credited Calap across multiple advisories. Calap is a prolific Apple security researcher with prior credits in CoreUI, Audio, and IOMobileFrameBuffer. |
| Vulnerability class history | TCC camera/mic bypasses are a recurring pattern in Apple security. Prior examples: CVE-2025-43530 (ScreenReader TCC bypass), CVE-2024-44133 (Safari camera/mic TCC bypass), CVE-2026-84589 (FaceTime TCC bypass). This class is actively sought by commercial spyware vendors (NSO, Intellexa, QuaDream). |
Sources.
- Apple Security Advisory — macOS Golden Gate 27.2
- Apple Security Advisory — macOS Tahoe 26.7.2
- Apple Security Advisory — visionOS 27.2
- Apple Security Advisory — iOS 27.2 and iPadOS 27.2
- SANS ISC — Apple Patches for October 2026
- CyberSecurityNews — iOS 27.2 163 Vulnerabilities
- Strix.ai — CVE-2026-86990 Details
- Forbes — How Spyware Bypasses Camera Indicator Dots
05 · The Call
Final Verdict
= UNCHANGED to MEDIUM (5.5/10)
Why this verdict
- Local access prerequisite: The attack requires a malicious app already executing on the target device. This is a post-initial-access amplifier, not an initial-access vector. On iOS, the App Store review process, Gatekeeper, and enterprise MDM restrictions create high friction for app delivery. This alone drops the practical severity well below what a 'camera access without permission' headline suggests.
- User interaction required: Even on macOS where sideloading is possible, the user must download, open, and (usually) approve execution of the malicious app. Modern macOS requires explicit Gatekeeper override for unsigned apps and notarization for signed ones. This is not a zero-click scenario.
- Impact scope is per-device, per-session: The vulnerability provides camera access on a single compromised device. It does not enable lateral movement, privilege escalation to root/kernel, domain compromise, or fleet-scale impact. Each device must be individually targeted and compromised.
- Role multiplier: The affected component (CoreMedia on consumer/enterprise endpoints) is NOT canonically a high-value-role component under the blast-radius catalog (it is not a DC, hypervisor, IdP, CI/CD server, backup system, PKI, or network edge appliance). (a) On low-value roles (personal phones, test devices) — trivial privacy nuisance. (b) On typical roles (managed enterprise iPhones/Macs) — privacy violation limited to that one user's camera feed, mitigated by MDM app controls. (c) On high-value roles (executive devices, devices in sensitive/classified environments) — targeted surveillance is the realistic worst case, but the blast radius remains *one device's camera*, not domain/fleet/supply-chain. The high-value floor rule does not apply because the component itself is not canonically high-value infrastructure, and even the worst-case outcome is single-device surveillance, not fleet compromise.
- Spyware relevance acknowledged but bounded: This vulnerability class (TCC camera bypass) is historically used by commercial spyware vendors (NSO Pegasus, Intellexa Predator). However, those vendors chain multiple 0-days (initial access + sandbox escape + kernel exploit + TCC bypass) — this CVE would be one link in such a chain, not sufficient alone. Without an initial-access companion, this bug sits unused.
Why not higher?
A HIGH rating would require either remote exploitability, active exploitation evidence, or fleet-scale blast radius. CVE-2026-86990 has none of these. The attack requires prior code execution on the device, there is no evidence of in-the-wild exploitation, no public PoC exists, and the impact is confined to the camera feed of a single device. While TCC bypasses are valuable to spyware vendors, the enterprise-relevant population of unmanaged macOS endpoints where sideloading is trivial is a subset, not the whole fleet.
Why not lower?
A LOW rating would undercount the privacy severity. Silent, unindiciated camera access is a meaningful confidentiality violation — the green dot is a *last line of defense* users rely on. On macOS, the sideloading friction is genuinely lower than on iOS, and the installed base of unmanaged developer Macs in enterprises is non-trivial. The vulnerability also affects visionOS, where camera bypass means full spatial-environment surveillance. The bug class's established value to spyware operators justifies keeping it at MEDIUM rather than LOW.
06 · Verification
Crowdsourced verification payload.
Run on each macOS target host (or via MDM script push) as any user. For iOS/iPadOS, check the OS version via MDM compliance reports instead. Example: bash check_cve_2026_86990.sh
#!/bin/bash
# check_cve_2026_86990.sh
# Checks whether the local macOS system is patched against CVE-2026-86990
# (CoreMedia camera TCC bypass)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -euo pipefail
os_name=$(sw_vers -productName 2>/dev/null || echo "unknown")
os_version=$(sw_vers -productVersion 2>/dev/null || echo "0.0.0")
if [[ "$os_name" != *"macOS"* && "$os_name" != *"Mac OS"* ]]; then
echo "UNKNOWN — this script targets macOS. For iOS/iPadOS, check via MDM."
exit 2
fi
# Compare version using sort -V
version_gte() {
# Returns 0 if $1 >= $2
[ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}
# macOS Golden Gate 27.x branch: fixed in 27.2
# macOS Tahoe 26.x branch: fixed in 26.7.2
major=$(echo "$os_version" | cut -d. -f1)
case "$major" in
27)
if version_gte "$os_version" "27.2"; then
echo "PATCHED — macOS $os_version >= 27.2 (CVE-2026-86990 fixed)"
exit 0
else
echo "VULNERABLE — macOS $os_version < 27.2 (CVE-2026-86990 applies)"
exit 1
fi
;;
26)
if version_gte "$os_version" "26.7.2"; then
echo "PATCHED — macOS $os_version >= 26.7.2 (CVE-2026-86990 fixed)"
exit 0
else
echo "VULNERABLE — macOS $os_version < 26.7.2 (CVE-2026-86990 applies)"
exit 1
fi
;;
*)
# Older macOS versions (25.x and below) — not listed as affected
# but also not confirmed patched; Apple may not backport
echo "UNKNOWN — macOS $os_version is not in the affected/patched version matrix for CVE-2026-86990."
echo "If running macOS Sequoia 15.x or earlier, check Apple advisories for backports."
exit 2
;;
esac