CVE-2026-84600
published 2026-09-14CVE-2026-84600: An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27…
PriorityP426medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.29%
20.1th percentile
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | macos | < 27 | 27 |
| apple | macos | < 27.0 | 27.0 |
| apple | tvos | < 27 | 27 |
| apple | tvos | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS up to 26 State Management improper authorization
vuldb·2026-09-15
CVE-2026-84600 [CRITICAL] Apple iOS/iPadOS/macOS/tvOS/visionOS/watchOS up to 26 State Management improper authorization
A vulnerability classified as critical has been found in Apple iOS, iPadOS, macOS, tvOS, visionOS and watchOS up to 26. Impacted is an unknown function of the component State Management. This manipulation causes improper authorization.
The identification of this vulnerability is CVE-2026-84600. It is possible to initiate the attack remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
An authorization issue was addressed with improved state management.
ghsa_unreviewed·2026-09-14
CVE-2026-84600 An authorization issue was addressed with improved state management.
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.
No detection rules found.
No public exploits indexed.
2026-09-14
Published