CVE-2026-84606 Overview
CVE-2026-84606 is a privacy vulnerability affecting multiple Apple operating systems. The flaw allows an application to identify a user across app reinstalls, defeating a core privacy control designed to prevent persistent tracking. Apple addressed the issue with improved handling of identifiers in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27. The weakness is categorized under [CWE-287] (Improper Authentication) and carries a network attack vector requiring no privileges or user interaction.
Critical Impact
A malicious or repurposed application can correlate user activity across reinstalls, undermining Apple's privacy model and enabling persistent user tracking without consent.
Affected Products
- Apple iOS (prior to iOS 27)
- Apple iPadOS (prior to iPadOS 27)
- Apple macOS (prior to macOS Golden Gate 27) and Apple visionOS (prior to visionOS 27)
Discovery Timeline
- 2026-09-14 - CVE-2026-84606 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84606
Vulnerability Analysis
The vulnerability stems from insufficient isolation of identifiers exposed to installed applications. On Apple platforms, application-scoped identifiers are expected to reset when a user removes and reinstalls an application. Under this flaw, one or more identifiers persist or can be reconstructed across reinstalls, giving an application a stable fingerprint of the user or device.
This breaks a fundamental privacy assumption: uninstalling an app should sever the link between prior sessions and any future install. Attackers or data brokers distributing seemingly legitimate apps can leverage this identifier persistence to build long-lived profiles. The issue affects integrity of privacy controls rather than data confidentiality on the device itself.
Apple's advisories describe the remediation as improved handling of identifiers, indicating the underlying identifier lifecycle or scoping logic was reworked. The affected surface spans iOS, iPadOS, macOS, and visionOS, suggesting a shared framework or system service is involved.
Root Cause
The root cause is improper identifier handling that permits an application to derive or retrieve the same value before and after reinstallation. Because the issue is classified under [CWE-287], the persistent identifier likely participates in an authentication or user-binding decision that should not survive an uninstall.
Attack Vector
Exploitation requires that a user install an application that queries the affected identifier. No elevated privileges or user interaction beyond normal app use are needed. The application records the identifier, and after uninstall and reinstall, retrieves the same or a derivable value, correlating the two sessions to the same user.
No public proof-of-concept or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Refer to the Apple Support Document #149034, Apple Support Document #149035, and Apple Support Document #149038 for vendor detail.
Detection Methods for CVE-2026-84606
Indicators of Compromise
- No file-based or network indicators have been published for this vulnerability, as exploitation occurs within legitimate application APIs and produces no distinctive artifacts.
- Unusual continuity of user-specific server-side state across app reinstalls may indicate identifier persistence abuse.
Detection Strategies
- Inventory Apple endpoints and compare installed OS build numbers against the fixed versions (iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27) using mobile device management (MDM) reporting.
- Review third-party applications with access to device or user identifiers for privacy policy compliance and known tracking behavior.
- Monitor App Store Connect analytics or MDM telemetry for applications that request identifier-adjacent entitlements without clear justification.
Monitoring Recommendations
- Track Apple security advisories for follow-on CVEs referencing the same identifier subsystem.
- Enforce MDM policies that report OS version drift and flag devices that fall behind the patched baseline.
- Audit enterprise applications distributed through internal channels for use of persistent identifier APIs.
How to Mitigate CVE-2026-84606
Immediate Actions Required
- Update all Apple devices to iOS 27, iPadOS 27, macOS Golden Gate 27, or visionOS 27 as applicable.
- Use MDM tooling to enforce minimum OS versions and quarantine non-compliant devices from sensitive resources.
- Review installed applications for those known to abuse device identifiers and remove or restrict them.
Patch Information
Apple has released fixes across the affected platforms. Consult the vendor advisories for exact build numbers and release notes: Apple Support Document #149034, Apple Support Document #149035, and Apple Support Document #149038. Patching is the only complete remediation because the issue resides in system identifier handling.
Workarounds
- Limit installation of untrusted third-party applications on managed devices until patches are deployed.
- Restrict application permissions that expose device or user identifiers via MDM configuration profiles.
- For high-sensitivity users, perform a full device reset before reinstalling applications known to fingerprint users.
# Example MDM query to identify devices requiring the update
mdm-cli devices list --platform ios --os-version-lt 27
mdm-cli devices list --platform ipados --os-version-lt 27
mdm-cli devices list --platform macos --os-version-lt 27
mdm-cli devices list --platform visionos --os-version-lt 27
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
