Apple Xcode: Multiple data confidentiality vulnerabilities (CVE-2026-112602, CVE-2026-112605)
Multiple vulnerabilities in Apple Xcode versions prior to 27.2 could allow an attacker to compromise data confidentiality.
CVE search metadata
CVE search record: CVE-2026-112602. EPSS: 0.14%. KEV: no. Product: Xcode (< 27.2). Brief: Apple Xcode: Multiple data confidentiality vulnerabilities (CVE-2026-112602, CVE-2026-112605). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apple-xcode-vulnerabilities/
CVE search record: CVE-2026-112605. EPSS: 0.14%. KEV: no. Product: Xcode (< 27.2). Brief: Apple Xcode: Multiple data confidentiality vulnerabilities (CVE-2026-112602, CVE-2026-112605). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apple-xcode-vulnerabilities/
Triage facts
Revision 1- Applicability
- Xcode (< 27.2)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Oct 30, 21:19 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Roughly even chance
Apple has released security updates to address multiple vulnerabilities in Xcode, specifically affecting versions prior to 27.2. These flaws, identified as CVE-2026-112602 and CVE-2026-112605, may allow an attacker to gain unauthorized access to sensitive information. No specific exploit details or delivery mechanisms were provided in the advisory.
Impact
The identified vulnerabilities present a risk to data confidentiality. The specific scope of information accessible depends on the nature of the underlying flaws within the Xcode environment.
Recommendation
- Inventory all systems running Xcode and update to version 27.2 or later immediately to mitigate CVE-2026-112602 and CVE-2026-112605.
- Audit developer environments for unauthorized access or anomalous activity following the application of the security update.
Mitigations
Upgrade all instances of Xcode to version 27.2 or later
CVE-2026-112602, CVE-2026-112605