{"id":"CVE-2026-84508","kind":"vulnerability","aliases":["CVE-2026-84508"],"related":[],"title":"Apple iOS and macOS: missing access check lets an app read protected user data","description":"This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.","summary":"Apple's advisory says an app can reach protected user data because the caller's access was not validated properly. Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7 and visionOS 27.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","ios","ipados","macos","other","visionos"],"not_affected_if":["already-patched"],"how_to_check":"- Check the OS version on each device: iOS and iPadOS under Settings > General > About, macOS under About This Mac.\n- unknown for fleet-wide checks, as the sources do not name a MDM or inventory command.","fix":"- Update iOS and iPadOS to `27` or later.\n- Update macOS Tahoe to `26.7` or later, and macOS Golden Gate to `27`.\n- Update visionOS to `27` or later.","status":"open","published_at":"2026-10-20T01:17:20+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:12:40+00:00","updated_at":"2026-10-25T04:12:40+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:12:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `27` or later.\n- Update macOS Tahoe to `26.7` or later, and macOS Golden Gate to `27`.\n- Update visionOS to `27` or later.","reach":"local","title":"Apple iOS and macOS: missing access check lets an app read protected user data","impact":"medium","summary":"Apple's advisory says an app can reach protected user data because the caller's access was not validated properly. Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7 and visionOS 27.","category":"other","nicknames":[],"who_cares":["apple","ios","macos","ipados","visionos"],"confidence":0.4,"needs_auth":"unknown","worst_case":"a malicious app reads protected user data on the device","analyst_note":"Check Apple's security notes for CVE-2026-84508 for affected components and whether a malicious app needs to be installed; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-84508 gave only the description.","how_to_check":"- Check the OS version on each device: iOS and iPadOS under Settings > General > About, macOS under About This Mac.\n- unknown for fleet-wide checks, as the sources do not name a MDM or inventory command.","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Teams that run Apple devices with user data protected by the OS, such as iPhones, iPads, Macs and Vision Pro headsets. The sources do not say which apps or data stores are reachable, so the exact exposure is unknown. Teams whose devices already run the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3284,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-84508':17A,20A '26.7':59B,91C '27':50B,52B,56B,62B,81C,84C,88C,93C 'abl':98C 'access':6A,42B,74C,100C 'address':66C 'advisori':29B 'app':10A,32B,95C 'appl':1A,21B,27B 'caller':40B,72C 'check':7A 'cve':15A,18A 'data':14A,37B,103C 'fix':47B,78C 'gate':55B,87C 'golden':54B,86C 'improv':68C 'io':2A,22B,49B,80C 'ipado':23B,51B,83C 'issu':64C,76C 'let':8A 'maco':4A,24B,53B,57B,85C,89C 'may':96C 'miss':5A 'proper':46B 'protect':12A,35B,101C 'reach':34B 'read':11A 'say':30B 'taho':58B,90C 'user':13A,36B,102C 'valid':45B,69C 'visiono':26B,61B,92C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Apple devices with user data protected by the OS, such as iPhones, iPads, Macs and Vision Pro headsets. The sources do not say which apps or data stores are reachable, so the exact exposure is unknown. Teams whose devices already run the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84508","severity":null,"published_at":"2026-10-20T01:17:20+00:00","modified_at":"2026-10-20T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}