CVE-2026-84573: Apple macOS Information Disclosure Flaw

CVE-2026-84573 Overview

CVE-2026-84573 is a local access control vulnerability in Apple macOS that allows an application to access sensitive user data. Apple addressed the flaw with improved checks in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The weakness is categorized under [CWE-284] Improper Access Control, meaning the affected component fails to correctly restrict which processes can reach protected data. Exploitation requires local access and low privileges but no user interaction. The impact is limited to confidentiality; integrity and availability are not affected.

Critical Impact
A malicious or compromised local application can read sensitive user data on unpatched macOS systems, bypassing intended access controls.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84573 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84573

Vulnerability Analysis

CVE-2026-84573 is an improper access control weakness in macOS that lets an installed application read sensitive user data it should not be authorized to access. Apple's advisory states the issue was resolved with improved checks, indicating the affected component did not sufficiently validate the caller's permissions before returning protected information. Because the flaw is exploitable locally with only low privileges and no user interaction, any process running in the user's session, including sandboxed or third-party applications, could abuse the weakness. Apple has not disclosed the specific subsystem, and no public proof-of-concept is available at this time.

Root Cause

The root cause is missing or insufficient permission validation in a macOS component that exposes user data. The fix adds runtime checks that gate access to the protected resource, aligning behavior with the Transparency, Consent, and Control (TCC) authorization model. Refer to Apple's advisories for the exact component boundaries: Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043.

Attack Vector

An attacker must first execute code locally on the target Mac, typically by convincing a user to install or run a malicious application. Once running, the application invokes the vulnerable interface and receives sensitive user data without triggering the expected authorization prompt or entitlement check. The attack requires no user interaction beyond the initial application launch.

No verified exploit code is publicly available. See the vendor advisories above for further technical detail.

Detection Methods for CVE-2026-84573

Indicators of Compromise

Unsigned or newly installed applications reading files under ~/Library, ~/Documents, or other TCC-protected locations without a corresponding user consent prompt.
Processes making unexpected calls to system frameworks that return user data such as contacts, photos, or location.
Outbound network connections from user-scope applications shortly after they touch protected data stores.

Detection Strategies

Correlate application install events with subsequent access to sensitive directories or TCC-controlled resources.
Baseline normal application behavior and alert on processes that suddenly enumerate personal data paths.
Review Unified Log entries for tccd decisions and access denials to identify anomalous permission patterns.

Monitoring Recommendations

Enable endpoint telemetry that captures process execution, file access, and framework calls on macOS hosts.
Track macOS build versions across the fleet and flag endpoints that remain below the patched versions.
Monitor MDM inventory reports for applications with broad file-system entitlements installed outside approved channels.

How to Mitigate CVE-2026-84573

Immediate Actions Required

Update macOS to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 as appropriate for each device.
Audit installed third-party applications and remove any that are unsigned, untrusted, or unused.
Verify that endpoint protection and MDM agents are reporting current OS build numbers.

Patch Information

Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Full advisory details are published in Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043.

Workarounds

Restrict application installation to signed and notarized software from trusted sources until patches are applied.
Enforce least-privilege user accounts and limit which applications receive Full Disk Access or other broad TCC permissions.
Use MDM configuration profiles to block or quarantine unapproved applications on managed endpoints.

bash

# Verify the installed macOS version on an endpoint
sw_vers -productVersion

# Trigger a software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart