{"id":"CVE-2026-84493","aliases":["EUVD-2026-110401","GHSA-rhxw-9xw4-437c"],"status":"published","title":"An authentication issue was addressed with improved state management. This issue is fixed in iOS...","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00139,"percentile":0.03358,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-10-26T20:42:58Z","modified":"2026-11-04T15:17:49Z","products":[{"vendor":"apple","product":"ios and ipados"},{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"}],"references":[{"url":"https://support.apple.com/en-us/149227","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/en-us/149230","tags":["Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84493"},{"url":"https://github.com/advisories/GHSA-rhxw-9xw4-437c"}],"sources":{"cve":[{"id":"CVE-2026-84493","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","status":"published","published":"2026-10-26T20:42:58.28Z","modified":"2026-11-04T14:38:05.601Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-04T15:32:52.697796Z"}],"euvd":[{"id":"EUVD-2026-110401","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","status":"published","published":"2026-10-26T20:42:58Z","modified":"2026-11-04T14:38:05Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T16:10:36.502596Z"}],"ghsa":[{"id":"GHSA-rhxw-9xw4-437c","title":"An authentication issue was addressed with improved state management. This issue is fixed in iOS...","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","status":"published","published":"2026-10-26T21:36:26Z","modified":"2026-11-02T18:32:07Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T19:02:39.544035Z"}],"nvd":[{"id":"CVE-2026-84493","description":"An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. A malicious app may be able to access Bluetooth without user consent.","status":"published","published":"2026-10-26T21:19:58.913Z","modified":"2026-11-04T15:17:49.843Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-04T18:06:23.753671Z"}]}}