CVE-2026-84609
A permissions issue was addressed with improved path validation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.61% probability · 48th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- apple/ipados · apple/iphone os · apple/macos · apple/tvos · apple/visionos · apple/watchos
- Source
- product-security@apple.com
EPSS 0.6% since 19 September 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://support.apple.com/en-us/149034Vendor Advisory
- https://support.apple.com/en-us/149035Vendor Advisory
- https://support.apple.com/en-us/149036Vendor Advisory
- https://support.apple.com/en-us/149037Vendor Advisory
- https://support.apple.com/en-us/149038Vendor Advisory
- https://support.apple.com/en-us/149042Vendor Advisory
- https://support.apple.com/en-us/149043Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.