CVE-2026-84585: Apple macOS Auth Bypass Vulnerability

CVE-2026-84585 Overview

CVE-2026-84585 is a permissions vulnerability in Apple macOS that allows an application to access local network devices without obtaining user consent. Apple addressed the flaw through improved state management in macOS Golden Gate 27. The weakness maps to [CWE-284] Improper Access Control and affects the local network permission enforcement layer that normally requires explicit user approval before an app can discover or communicate with devices on the same network segment.

Critical Impact
An unauthorized application can enumerate and interact with local network devices, exposing sensitive information about the user's network environment without consent.

Affected Products

Apple macOS versions prior to Golden Gate 27

Discovery Timeline

2026-09-14 - CVE-2026-84585 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84585

Vulnerability Analysis

The vulnerability resides in the macOS local network access control layer. Apple introduced the local network privacy prompt to require user consent before applications can send or receive traffic on the local network. The flaw allows an application to bypass this consent gate through a state management defect. Once bypassed, the application can perform local network device discovery, enumerate services via mDNS or similar protocols, and communicate with printers, cameras, routers, or IoT devices without user awareness.

Apple's advisory attributes the fix to improved state management, indicating the underlying issue involved inconsistent tracking of permission state across application lifecycle transitions or entitlement checks. Exploitation requires local access and user interaction, which limits remote attack scenarios but remains relevant for malicious apps distributed through non-App Store channels or supply chain compromises.

Root Cause

The root cause is improper access control [CWE-284] tied to how macOS maintained the local network permission state for requesting applications. Inconsistent state evaluation permitted an application to proceed with local network operations even when explicit user consent had not been granted for that specific access path.

Attack Vector

Exploitation requires a local application running on the target macOS system and user interaction, typically launching or interacting with the malicious app. Once executed, the app can silently probe the local subnet, fingerprint devices, and interact with exposed services. The vulnerability does not grant code execution or data modification on the host, but it does enable reconnaissance and potential lateral movement toward other network-connected devices.

No public exploit code or proof-of-concept has been published for CVE-2026-84585. Refer to the Apple Support Document for vendor technical context.

Detection Methods for CVE-2026-84585

Indicators of Compromise

Unexpected outbound mDNS, SSDP, or Bonjour traffic originating from user-installed applications that have not been granted local network permission.
Applications initiating TCP or UDP connections to RFC 1918 addresses on the local subnet without a corresponding permission prompt in system logs.
Presence of unsigned or ad-hoc signed applications performing network scanning behavior shortly after launch.

Detection Strategies

Monitor macOS Unified Logging for networkextension and TCC subsystem entries related to local network access decisions.
Correlate process execution telemetry with network flow data to identify applications generating local subnet traffic without documented business need.
Baseline expected local network access patterns for managed applications and alert on deviations.

Monitoring Recommendations

Enable endpoint telemetry that captures process-to-network correlation on macOS fleets.
Review the com.apple.network.local permission grants across managed endpoints using MDM reporting.
Track application installations from outside the Mac App Store and flag those making early local network calls.

How to Mitigate CVE-2026-84585

Immediate Actions Required

Upgrade all macOS endpoints to macOS Golden Gate 27 or later.
Audit installed applications for unexpected local network access grants and revoke where not required.
Restrict installation of applications from unidentified developers through Gatekeeper policy enforcement.

Patch Information

Apple resolved CVE-2026-84585 in macOS Golden Gate 27 through improved state management of local network permissions. Deploy the update via Software Update or your MDM platform. See the Apple Support Document for the full advisory.

Workarounds

Restrict application installation to vetted sources until the patch is applied.
Segment sensitive local network devices onto separate VLANs to limit reconnaissance exposure.
Remove or disable non-essential applications that request local network access.

bash

# Verify current macOS version and update status
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all --restart