{"history":[{"alert":0,"cve":"CVE-2026-113963","id":23089,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00138, \"percentile\": 0.03262}"},{"alert":0,"cve":"CVE-2026-113963","id":20607,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00138, \"percentile\": 0.03238}"},{"alert":1,"cve":"CVE-2026-113963","id":18894,"kind":"cna","observed_at":1794306001,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2026-113963\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-09T21:02:13.966430Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-09T21:02:18.617Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"iOS and iPadOS\", \"vendor\": \"Apple\", \"versions\": [{\"lessThan\": \"27.2.1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"product\": \"visionOS\", \"vendor\": \"Apple\", \"versions\": [{\"lessThan\": \"27.2.1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}, {\"product\": \"watchOS\", \"vendor\": \"Apple\", \"versions\": [{\"lessThan\": \"27.2.1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"An app may be able to access sensitive user data\", \"lang\": \"en\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-09T20:27:59.961Z\", \"orgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"shortName\": \"apple\"}, \"references\": [{\"url\": \"https://support.apple.com/en-us/149715\"}, {\"url\": \"https://support.apple.com/en-us/149722\"}, {\"url\": \"https://support.apple.com/en-us/149724\"}]}}, \"cveMetadata\": {\"assignerOrgId\": \"286789f9-fbc2-4510-9f9a-43facdede74c\", \"assignerShortName\": \"apple\", \"cveId\": \"CVE-2026-113963\", \"datePublished\": \"2026-11-09T20:27:59.961Z\", \"dateReserved\": \"2026-10-20T21:06:55.480Z\", \"dateUpdated\": \"2026-11-09T21:02:18.617Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-113963","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:13.966430Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T21:02:18.617Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data."}],"problemTypes":[{"descriptions":[{"description":"An app may be able to access sensitive user data","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-09T20:27:59.961Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"url":"https://support.apple.com/en-us/149715"},{"url":"https://support.apple.com/en-us/149722"},{"url":"https://support.apple.com/en-us/149724"}]}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2026-113963","datePublished":"2026-11-09T20:27:59.961Z","dateReserved":"2026-10-20T21:06:55.480Z","dateUpdated":"2026-11-09T21:02:18.617Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794435601,"cve":"CVE-2026-113963","description":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data.","epss":{"date":"2026-11-12","epss":0.00138,"percentile":0.03262},"epss_checked":1794522003,"first_seen":1794290456,"kev":null,"kev_checked":1794522003,"products":"Apple iOS and iPadOS, Apple visionOS, Apple watchOS","references":["https://support.apple.com/en-us/149715","https://support.apple.com/en-us/149722","https://support.apple.com/en-us/149724"],"score":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"CVE-2026-113963","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://xakep.ru/2026/11/11/worse_query/","id":413,"publisher":"Xakep","title":"Binance: \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 iOS \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432"},{"canonical_url":"https://support.apple.com/en-us/149715","id":284,"publisher":"Apple Security","title":"About the security content of iOS 27.2.1 and iPadOS 27.2.1 - Apple Support"}]}