CVE-2026-84609
published 2026-09-14CVE-2026-84609: A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS…
PriorityP343critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.66%
51.2th percentile
A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_and_ipados | < 27 | 27 |
| apple | ipados | < 27.0 | 27.0 |
| apple | iphone_os | < 27.0 | 27.0 |
| apple | macos | < 15.8 | 15.8 |
| apple | macos | < 26.7 | 26.7 |
| apple | macos | < 27 | 27 |
| apple | macos | >= 15.0 < 15.8 | 15.8 |
| apple | macos | >= 26.0 < 26.7 | 26.7 |
| apple | tvos | < 27 | 27 |
| apple | tvos | < 27.0 | 27.0 |
| apple | visionos | < 27 | 27 |
| apple | visionos | < 27.0 | 27.0 |
| apple | watchos | < 27 | 27 |
| apple | watchos | < 27.0 | 27.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior 27/15.8/26.7 Path Validation permission
vuldb·2026-09-15
CVE-2026-84609 [CRITICAL] Apple iPadOS/iOS/macOS/tvOS/visionOS/watchOS prior 27/15.8/26.7 Path Validation permission
A vulnerability described as critical has been identified in Apple iPadOS, iOS, macOS, tvOS, visionOS and watchOS. Affected is an unknown function of the component Path Validation. Executing a manipulation can lead to permission issues.
This vulnerability is handled as CVE-2026-84609. It is possible to launch the attack on the local host. There is not any exploit available.
Upgrading the affected component is recommended.
GHSA
A permissions issue was addressed with improved path validation.
ghsa_unreviewed·2026-09-14
CVE-2026-84609 A permissions issue was addressed with improved path validation.
A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files.
No detection rules found.
No public exploits indexed.
2026-09-14
Published