CVE-2026-84600: Apple iPadOS Authorization Bypass Vulnerability

CVE-2026-84600 Overview

CVE-2026-84600 is an authorization vulnerability affecting multiple Apple operating systems. The flaw allows a malicious shortcut to send messages without user confirmation, bypassing the standard consent prompt that normally protects the Messages workflow. Apple resolved the issue through improved state management in the Shortcuts subsystem. The weakness is categorized under Improper Authorization [CWE-285] and requires user interaction to trigger, typically by running a crafted shortcut. Successful exploitation results in unauthorized message transmission on behalf of the user, which can enable social engineering, spam, or impersonation scenarios against contacts.

Critical Impact
A malicious shortcut can send messages from the victim's device without the user confirmation dialog, enabling silent abuse of the Messages functionality.

Affected Products

Apple iOS 27 and iPadOS 27 (prior to the fixed release)
Apple macOS Golden Gate 27, tvOS 27, and visionOS 27 (prior to the fixed releases)
Apple watchOS 27 (prior to the fixed release)

Discovery Timeline

2026-09-14 - CVE-2026-84600 published to the National Vulnerability Database
2026-09-18 - CVE-2026-84600 last updated in NVD

Technical Details for CVE-2026-84600

Vulnerability Analysis

The vulnerability resides in Apple's Shortcuts framework, which allows users to automate tasks across system applications including Messages. Under normal conditions, sending a message through a shortcut triggers a confirmation prompt that requires explicit user approval. CVE-2026-84600 undermines this consent gate through a state management defect, allowing a crafted shortcut to reach the send path without displaying the confirmation dialog.

Apple describes the fix as improved state management, indicating that the authorization decision was influenced by mutable state that a shortcut could manipulate. The vulnerability affects the entire Apple platform family running the version 27 line, including iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS. The flaw is tracked as an authorization issue under [CWE-285].

Root Cause

The root cause is inadequate tracking of the authorization state associated with a shortcut action targeting Messages. The Shortcuts runtime evaluated whether user confirmation had been obtained using state that could be reached in a way that bypasses the prompt. Because the check relied on transient state rather than a per-action authoritative decision, a malicious shortcut could reach the message dispatch code path in an authorized-looking state without the user having approved the action.

Attack Vector

An attacker distributes a malicious shortcut through a shortcut sharing link, iCloud, email, messaging, or a compromised website. The victim installs and runs the shortcut, which invokes the Messages send action. Because of the state management flaw, the runtime dispatches the message without prompting for confirmation. The recipient list and message body are attacker-controlled, so the attacker can send phishing content or impersonation messages from the victim's identity. No elevated privileges are required, but the victim must execute the shortcut for exploitation to succeed.

No verified proof-of-concept code is publicly available. Refer to the Apple security advisories for vendor-provided details.

Detection Methods for CVE-2026-84600

Indicators of Compromise

Outbound iMessage or SMS traffic from a device that the user did not intentionally send, particularly bursts of messages to contacts or unknown numbers.
Recently installed shortcuts from untrusted sources or shortcut sharing links received through email, chat, or social media.
Reports from contacts describing suspicious messages purportedly sent by the user, including phishing links or unusual requests.

Detection Strategies

Audit installed shortcuts on managed Apple devices and flag those imported from external URLs or sideloaded outside the official Gallery.
Correlate Messages activity logs with user session activity to identify sends that occurred without corresponding user interaction.
Monitor mobile device management (MDM) telemetry for devices running vulnerable OS versions that have not received the patched build.

Monitoring Recommendations

Track Apple OS build versions across the fleet through MDM inventory reports and alert on devices still on pre-patch version 27 builds.
Enable user reporting workflows so recipients of suspicious messages from internal users can quickly escalate potential compromise.
Review Shortcuts automation logs on macOS through the unified logging subsystem for anomalous Messages actions.

How to Mitigate CVE-2026-84600

Immediate Actions Required

Update all Apple devices to the patched releases: iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Instruct users to remove any shortcuts installed from untrusted sources and to avoid running shortcuts received through unsolicited links.
Enforce OS update compliance through MDM policies and quarantine non-compliant devices from sensitive resources.

Patch Information

Apple addressed CVE-2026-84600 through improved state management in the Shortcuts subsystem. Fixed versions are listed in the vendor advisories: Apple Support Article 149034, Article 149035, Article 149036, Article 149037, and Article 149038.

Workarounds

Disable execution of untrusted shortcuts by keeping the Shortcuts privacy setting that blocks non-Gallery shortcuts enabled where feasible.
Restrict the Messages entitlement for shortcut automations on supervised devices through configuration profiles until the patch is applied.
Educate users to inspect shortcut actions before running any imported automation, particularly those that reference Messages or Contacts.

bash

# Verify installed iOS/iPadOS build via MDM query or on-device check
# Settings > General > About > Software Version
# Ensure the version corresponds to the patched 27 release listed in the Apple advisory