CVE-2026-84598: Apple iPadOS Path Traversal Vulnerability

CVE-2026-84598 Overview

CVE-2026-84598 is a path traversal vulnerability affecting Apple iOS and iPadOS. An attacker with physical access to a trust-paired device can read and write arbitrary files on the target system. Apple addressed the flaw through improved path validation in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27. The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
An attacker with physical access to a trust-paired device can bypass path validation controls to read and write arbitrary files, leading to sensitive data disclosure and potential integrity compromise.

Affected Products

Apple iOS versions prior to 26.7 and 27
Apple iPadOS versions prior to 26.7 and 27
Devices in a trust-paired state with an attacker-controlled host

Discovery Timeline

2026-09-14 - CVE-2026-84598 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84598

Vulnerability Analysis

The flaw is a path traversal weakness in a component that accepts file paths from a trust-paired host. Insufficient validation allows an attacker to supply crafted path sequences that escape the intended directory scope. Successful exploitation permits both read and write access to files outside authorized boundaries on the device file system.

Exploitation requires the attacker to have physical access to a device that has already been trust-paired with a computer. Trust pairing establishes a persistent relationship enabling file transfer and diagnostic operations. Once trust exists, the attacker can issue file operations that leverage the path traversal condition. This scenario is common in device recovery, forensic examination, and lost-or-stolen device situations.

Root Cause

The root cause is improper path validation in code that handles file system operations initiated from a paired host. The affected component did not adequately canonicalize or restrict paths containing traversal sequences before performing file access. Apple's fix introduces stronger path validation to reject inputs that resolve outside expected directories.

Attack Vector

Exploitation requires a trust-paired connection between the attacker's host and the victim device. The attacker sends crafted file path requests over the pairing channel to access files outside the sandbox intended for host-initiated operations. No user interaction on the device is required once trust has been established.

Because this issue requires an existing trust relationship, the practical attack surface centers on devices lost, stolen, or briefly left unattended after being paired with a computer the attacker later controls.

Detection Methods for CVE-2026-84598

Indicators of Compromise

Unexpected pairing records or lockdown certificates on host systems that connect to managed iOS or iPadOS devices
Anomalous file transfer sessions initiated over USB or Wi-Fi sync channels outside of standard MDM workflows
Device logs showing file access operations referencing paths outside expected sandbox directories

Detection Strategies

Monitor Mobile Device Management (MDM) telemetry for iOS and iPadOS versions running below 26.7 or 27 across the fleet
Review pairing records on managed macOS and Windows endpoints to identify unauthorized trust relationships with corporate mobile devices
Correlate physical access events (device checkout, loss reports) with subsequent unusual device behavior or data exposure

Monitoring Recommendations

Track OS version compliance for all enrolled iOS and iPadOS devices through the MDM console
Alert on new pairing events between managed mobile devices and non-corporate hosts
Audit devices that have been out of custody for any period and consider re-provisioning them

How to Mitigate CVE-2026-84598

Immediate Actions Required

Update all affected devices to iOS 26.7, iPadOS 26.7, iOS 27, or iPadOS 27 as documented in the Apple security advisories
Enforce upgrade policies through MDM to block non-compliant devices from accessing corporate resources
Reset trust relationships on devices that may have been physically accessed by untrusted parties

Patch Information

Apple released patches in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27. Details are available in Apple Support Article #149034 and Apple Support Article #149041. The fix implements improved path validation to reject traversal sequences.

Workarounds

Enable a strong device passcode and biometric authentication to prevent unauthorized physical access
Avoid pairing devices with untrusted computers and revoke existing pairings using the Reset Location & Privacy option
Enable USB Restricted Mode to limit accessory access when the device has been locked for an extended period
Maintain physical custody of devices and report loss immediately so remote wipe can be initiated

bash

# Configuration example: Query iOS/iPadOS version compliance via MDM
# Sample compliance rule (pseudocode for MDM policy)
compliance_rule:
  platform: iOS
  minimum_version: "26.7"
  action_on_noncompliance: block_corporate_access

compliance_rule:
  platform: iPadOS
  minimum_version: "26.7"
  action_on_noncompliance: block_corporate_access