CERT-FR: Apple Xcode before 27.2 fixes multiple vulnerabilities enabling confidentiality breach
The French CERT-FR published advisory CERTFR-2026-AVI-1421 on 30 October 2026 about multiple vulnerabilities in Apple products. The advisory states that the flaws allow an attacker to compromise data confidentiality. The only affected product listed is Xcode before version 27.2. The advisory does not mention exploitation in the wild and gives no CVSS scores or per-CVE technical details.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1421 (30 October 2026) covers multiple vulnerabilities in Apple Xcode, tracked as CVE-2026-112602 and CVE-2026-112605. Per the advisory, they let an attacker breach data confidentiality. Versions before 27.2 are affected, and the fix is in Xcode 27.2, described in Apple security bulletin 149589 of 29 October 2026. The advisory gives no CVSS scores, no per-CVE details, and no information on the attacker's prerequisites (network access, authentication, user interaction). It does not mention exploitation in the wild.
Como foi descoberta
The articles do not say how the flaws were found or who reported them. They only show that Apple published security bulletin 149589 on 29 October 2026, and that CERT-FR relayed it the next day in advisory CERTFR-2026-AVI-1421. Neither mentions exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:23.
Detalhes técnicos
- Affected product: Xcode versions prior to 27.2.
- Impact class: data confidentiality breach.
- CVEs referenced: CVE-2026-112602 and CVE-2026-112605, as described in Apple security bulletin 149589 of 29 October 2026.
Remediação
- Update Xcode to version 27.2 or later, following Apple security bulletin 149589 (https://support.apple.com/en-us/149589).
Linha do tempo
-
CERT-FR: Apple Xcode before 27.2 fixes multiple vulnerabilities enabling confidentiality breach
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1421 on 30 October 2026 about multiple vulnerabilities in Apple products. The advisory states that the flaws allow an attacker to compromise data confidentiality. The only affected product listed is Xcode before version 27.2. The advisory does not mention exploitation in the wild and gives no CVSS scores or per-CVE technical details.
Technical Details
- Affected product: Xcode versions prior to 27.2.
- Impact class: data confidentiality breach.
- CVEs referenced: CVE-2026-112602 and CVE-2026-112605, as described in Apple security bulletin 149589 of 29 October 2026.
Remediation
- Update Xcode to version 27.2 or later, following Apple security bulletin 149589 (https://support.apple.com/en-us/149589).