CVE-2026-84508
Received Received - Intake

Improper Access Control in Apple iOS and macOS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apple Inc.

Description
This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-84508
EUVD
EUVD-2026-104704

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Apple iOS and iPadOS 0
Apple macOS 0
Apple macOS 0
Apple visionOS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an app being able to access protected user data due to insufficient validation of the caller's access permissions. It affects multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive user data stored on the device, potentially leading to privacy breaches or data theft.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations such as GDPR or HIPAA by allowing unauthorized access to personal or sensitive health information.

Mitigation Strategies

Update affected Apple devices to the latest versions: iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, or visionOS 27 to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart