{"id":"CVE-2026-84633","kind":"vulnerability","aliases":["CVE-2026-84633"],"related":[],"title":"Apple macOS: path traversal lets an app break out of its sandbox","description":"A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.","summary":"A path traversal flaw in macOS allows an app to escape its sandbox. Apple fixed it in macOS Golden Gate 27, and the sources give no further technical detail.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","macos","other"],"not_affected_if":["already-on-golden-gate-27"],"how_to_check":"- Run `sw_vers -productVersion` on each Mac to see the installed macOS version.\n- Check that the version is at or above the fixed release listed in Apple's security notes.","fix":"- Update macOS to `Golden Gate 27` or later through System Settings > General > Software Update.","status":"open","published_at":"2026-10-26T21:20:20+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:05+00:00","updated_at":"2026-10-26T21:57:05+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:57:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `Golden Gate 27` or later through System Settings > General > Software Update.","reach":"local","title":"Apple macOS: path traversal lets an app break out of its sandbox","impact":"medium","summary":"A path traversal flaw in macOS allows an app to escape its sandbox. Apple fixed it in macOS Golden Gate 27, and the sources give no further technical detail.","category":"other","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A sandboxed app escapes its restrictions and reaches files outside its sandbox.","analyst_note":"Check Apple's security release notes for the affected macOS versions and whether a local app or user action is required; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-84633 has no further detail.","how_to_check":"- Run `sw_vers -productVersion` on each Mac to see the installed macOS version.\n- Check that the version is at or above the fixed release listed in Apple's security notes.","needs_analyst":true,"not_affected_if":["already-on-golden-gate-27"],"who_is_affected":"Any Mac running a macOS release older than Golden Gate 27 may be affected, since the flaw is in the operating system's path validation. The sources do not say which earlier releases are vulnerable or whether an attacker needs a local app already running, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000596,"input_tokens":3242,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84633':15A,18A '27':42B,69C 'abl':74C 'address':56C 'allow':28B 'app':7A,30B,71C 'appl':1A,19B,35B 'break':8A,76C 'cve':13A,16A 'detail':50B 'endpoint':20B 'escap':32B 'fix':36B,64C 'flaw':25B 'gate':41B,68C 'give':46B 'golden':40B,67C 'improv':58C 'issu':54C,62C 'let':5A 'maco':2A,21B,27B,39B,66C 'may':72C 'path':3A,23B,52C,59C 'sandbox':12A,34B,80C 'sourc':45B 'technic':49B 'travers':4A,24B,53C 'valid':60C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release older than Golden Gate 27 may be affected, since the flaw is in the operating system's path validation. The sources do not say which earlier releases are vulnerable or whether an attacker needs a local app already running, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84633","severity":null,"published_at":"2026-10-26T21:20:20+00:00","modified_at":"2026-10-26T21:20:20+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}