CVE-2026-84601: Apple macOS Auth Bypass Vulnerability

CVE-2026-84601 Overview

CVE-2026-84601 is an authorization vulnerability [CWE-863] in Apple macOS that allows a local application to bypass Apple Intelligence security prompts. The flaw stems from improper state management in the permissions subsystem that governs access to Apple Intelligence features. Apple addressed the issue in macOS Golden Gate 27 through improved state tracking. The vulnerability requires local access and low privileges, and it does not require user interaction. Successful exploitation impacts integrity by allowing an app to perform actions that should require explicit user consent through Apple Intelligence prompts.

Critical Impact
A local application can bypass Apple Intelligence security prompts and act on behalf of the user without the consent gate being enforced.

Affected Products

Apple macOS versions prior to macOS Golden Gate 27
Systems with Apple Intelligence enabled
Third-party apps running under a standard local user context on affected macOS builds

Discovery Timeline

2026-09-14 - CVE-2026-84601 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84601

Vulnerability Analysis

The vulnerability is an authorization flaw classified under [CWE-863] Incorrect Authorization. Apple Intelligence relies on user-facing security prompts to gate sensitive operations such as data access, model invocations, and cross-app actions. The permissions subsystem tracks the authorization state of the requesting app across the prompt lifecycle. Improper state management allows an application to reach a code path where the authorization check is skipped or evaluated against stale state. The result is that an app performs a protected Apple Intelligence action without the prompt being shown or without a valid user grant.

The attack vector is local, meaning the attacker must already run code on the target macOS system. The impact is scoped to integrity, with no direct confidentiality or availability impact recorded. See the Apple Security Advisory for vendor detail.

Root Cause

The root cause is improper state management in the code that evaluates Apple Intelligence permissions. Authorization decisions depend on transient state that can be manipulated or observed at an incorrect point in the prompt workflow. Apple's fix hardens state tracking so that permission checks always reflect a consistent, current view of the user's consent.

Attack Vector

An attacker with the ability to run an unprivileged local application on the target macOS system can invoke Apple Intelligence functionality through the affected code path. The app triggers the action in a way that reaches the authorization check while the permission state is inconsistent, causing the prompt to be suppressed or the check to succeed without user approval. No user interaction is required.

No public proof-of-concept or exploit code is available for CVE-2026-84601. Refer to Apple's advisory for further technical guidance.

Detection Methods for CVE-2026-84601

Indicators of Compromise

Apple Intelligence actions performed by processes that have no corresponding user-approved TCC or Apple Intelligence entitlement grant.
Unexpected child processes or XPC calls to Apple Intelligence services originating from non-Apple, unsigned, or ad-hoc signed binaries.
macOS Unified Log entries showing Apple Intelligence request handling without a matching prompt display event.

Detection Strategies

Inventory endpoints and identify macOS hosts running builds prior to macOS Golden Gate 27 with Apple Intelligence enabled.
Correlate process execution telemetry with Apple Intelligence service invocations to flag apps that access these services without a corresponding user consent event.
Hunt for local applications that spawn shortly before anomalous Apple Intelligence activity, focusing on apps installed outside the App Store or with recent first-seen timestamps.

Monitoring Recommendations

Ingest macOS Unified Logs and endpoint process telemetry into a centralized data lake for cross-host correlation.
Alert on new or rarely seen binaries invoking Apple Intelligence XPC endpoints on unpatched hosts.
Track patch state of macOS builds as a first-class monitoring signal and alert when systems drift below macOS Golden Gate 27.

How to Mitigate CVE-2026-84601

Immediate Actions Required

Upgrade all affected macOS systems to macOS Golden Gate 27 or later.
Restrict installation of untrusted local applications, especially on hosts where Apple Intelligence is enabled.
Audit currently granted Apple Intelligence and TCC permissions and revoke entries that do not match an approved application inventory.

Patch Information

Apple fixed CVE-2026-84601 in macOS Golden Gate 27 by improving state management in the Apple Intelligence permissions subsystem. Details are documented in the Apple Security Advisory. Administrators should deploy the update through their standard macOS patch management workflow and confirm the build version post-install.

Workarounds

Disable Apple Intelligence on systems that cannot be updated immediately to remove the affected attack surface.
Enforce application allowlisting so only signed, vetted applications can execute on managed macOS endpoints.
Limit standard user accounts from installing new applications until the patch is deployed.

bash

# Verify macOS build and Apple Intelligence status
sw_vers -productVersion
sw_vers -buildVersion

# Confirm the host is at or above macOS Golden Gate 27 before re-enabling Apple Intelligence
# If not patched, disable Apple Intelligence via:
# System Settings > Apple Intelligence & Siri > Apple Intelligence (toggle off)