CVE-2026-84508

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-20 · updated 2026-10-26
Weakness: CWE-284

Description

This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.

Affected products

Apple iOS and iPadOS: before 27 — fixed in 27
Apple macOS: before 26.7; before 27 — fixed in 26.7, 27
Apple visionOS: before 27 — fixed in 27

How to fix

Upgrade to a fixed version: Apple iOS and iPadOS 27; Apple macOS 26.7, 27; Apple visionOS 27. Check the vendor advisory for mitigations.

References

https://support.apple.com/en-us/149034
https://support.apple.com/en-us/149035
https://support.apple.com/en-us/149038
https://support.apple.com/en-us/149042

Get alerted when CVE-2026-84508 or the next vulnerability affects your stack