CVE-2026-84587: Apple macOS Privilege Escalation Vulnerability

CVE-2026-84587 Overview

CVE-2026-84587 is a permissions vulnerability in Apple macOS that allows an app to access protected user data. Apple addressed the issue with additional access restrictions across three supported macOS releases. The flaw is categorized under [CWE-269] Improper Privilege Management and requires local access with low privileges to exploit. No user interaction is needed for exploitation, which increases the risk for systems running unvetted third-party applications.

Critical Impact
A malicious or malformed application running on a vulnerable macOS system can bypass permission controls and read protected user data without triggering user consent prompts.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84587 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84587

Vulnerability Analysis

CVE-2026-84587 stems from an improper permission enforcement in macOS that permits an application to reach files or resources classified as protected user data. Protected user data on macOS includes categories such as Contacts, Calendars, Photos, and files in user-designated directories, all normally guarded by Transparency, Consent, and Control (TCC).

The vulnerability enables a locally installed app to obtain access to these resources without the standard consent prompt or entitlement checks. Because the attack vector is local and requires only low privileges, any application executing in a user context can attempt exploitation. Successful exploitation exposes sensitive files and metadata to unauthorized processes, undermining the isolation model that TCC provides.

Root Cause

Apple describes the underlying defect as a permissions issue that has now been addressed with additional restrictions. The fix suggests the original access control logic did not correctly evaluate an app's authorization to reach specific protected resources. This matches the [CWE-269] classification, which covers cases where a component performs actions with more privilege than intended.

Attack Vector

Exploitation requires an attacker to run code locally on the target macOS system. This can be achieved through a signed but malicious application, a compromised legitimate app, or a supply-chain intrusion affecting a developer's tooling. Once the app runs under any interactive user account, it can invoke the flawed permission path and read protected user data without prompting.

No verified exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for vendor-provided technical detail.

Detection Methods for CVE-2026-84587

Indicators of Compromise

Applications accessing files under ~/Library/Application Support/, ~/Documents/, ~/Contacts/, or Photos libraries without a corresponding TCC prompt entry in TCC.db.
Unexpected process reads of protected user data directories by binaries lacking the appropriate com.apple.security.personal-information.* entitlements.
Newly installed or recently updated third-party apps generating outbound network traffic shortly after touching protected user data paths.

Detection Strategies

Audit TCC.db entries and compare granted permissions against actual file access telemetry to identify divergences.
Use Endpoint Security framework subscribers to monitor ES_EVENT_TYPE_NOTIFY_OPEN events on protected directories from non-Apple signed binaries.
Correlate process ancestry, code signature, and file access patterns to flag apps that read protected data without prior user consent.

Monitoring Recommendations

Forward macOS Unified Logs (log stream --predicate 'subsystem == "com.apple.TCC"') to a central SIEM for anomaly analysis.
Track macOS version inventory to identify hosts running builds below Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.
Alert on installation of unsigned or ad-hoc signed applications that request access to user data resources.

How to Mitigate CVE-2026-84587

Immediate Actions Required

Update all macOS endpoints to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7, whichever aligns with the installed major version.
Inventory installed third-party applications and remove those from untrusted sources or without valid Developer ID signatures.
Review TCC-granted permissions in System Settings and revoke access for apps that do not require it.

Patch Information

Apple resolved CVE-2026-84587 by adding further restrictions on access to protected user data. Patched builds are documented in Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043. Administrators should deploy the applicable update through Mobile Device Management (MDM) or Software Update.

Workarounds

Restrict installation of applications to those distributed through the Mac App Store or notarized by Apple.
Enforce application allow-listing via MDM configuration profiles to prevent execution of unapproved binaries.
Limit standard user accounts from installing new software, reducing the opportunity for a malicious app to run locally.

bash

# Verify installed macOS version against fixed releases
sw_vers -productVersion

# Trigger a software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart