CVE-2026-84612: Apple iPadOS Authorization Bypass Vulnerability

CVE-2026-84612 Overview

CVE-2026-84612 is an authorization vulnerability affecting multiple Apple operating systems. A local application can bypass access controls to read persistent device identifiers. Apple resolved the issue by improving access control checks across its platform lineup, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The weakness is categorized under CWE-863: Incorrect Authorization and requires local access with user interaction. While no public exploit code or in-the-wild exploitation has been reported, persistent identifiers enable long-term device tracking and cross-app correlation, which undermines Apple's privacy model.

Critical Impact
A malicious application installed on an affected device can read persistent device identifiers, enabling stable user tracking and fingerprinting across sessions and app boundaries.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26.7 / iPadOS 26.7 and iOS 27 / iPadOS 27)
Apple macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27
Apple tvOS 27, visionOS 27, and watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-84612 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84612

Vulnerability Analysis

The flaw is an authorization weakness that allows an installed application to access persistent device identifiers without holding the required entitlements or user consent. Persistent identifiers, unlike rotating advertising IDs, remain stable across app installs and reboots. Access to such values defeats Apple's per-app identifier scoping and enables cross-application user tracking. The Apple advisories describe the fix as improved access control, indicating that the resource check itself was missing or insufficiently restrictive for the identifier interface. Because the attack vector is local and requires user interaction to install the malicious app, exploitation depends on tricking a user into running attacker-controlled code.

Root Cause

The root cause is incorrect authorization ([CWE-863]) in the subsystem exposing persistent device identifiers. The affected interface did not adequately validate whether the calling process was authorized to read the identifier, allowing sandboxed applications to retrieve values reserved for privileged callers. Apple addressed the defect by tightening the access control logic across all affected platforms.

Attack Vector

Exploitation requires an attacker to deliver an application to the target device through the App Store, TestFlight, sideloading, or enterprise distribution channels. Once installed and executed by the user, the application invokes the vulnerable identifier API and receives the persistent value in return. No elevation of privilege or additional exploit primitive is required. The retrieved identifier can then be exfiltrated to a remote server and used to correlate the device across services, advertising networks, or attacker infrastructure.

No verified public proof-of-concept is available. See the Apple security advisories for vendor technical details.

Detection Methods for CVE-2026-84612

Indicators of Compromise

Applications making unexpected calls to identifier-related system APIs shortly after install or launch.
Outbound network connections from third-party apps carrying opaque, stable identifier strings to non-vendor endpoints.
Presence of apps distributed outside the App Store or from unverified enterprise developer certificates on managed devices.

Detection Strategies

Inventory installed applications through Mobile Device Management (MDM) and flag those requesting entitlements or capabilities inconsistent with their stated purpose.
Correlate app telemetry with network egress logs to identify applications transmitting persistent, high-entropy identifiers to unfamiliar hosts.
On macOS, use Endpoint Security Framework subscribers to monitor process access to identifier-related IOKit and system configuration interfaces.

Monitoring Recommendations

Track OS build versions across the fleet and alert on devices running builds older than iOS 26.7, iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, or watchOS 27.
Review MDM compliance reports for devices that have not received the September 2026 Apple security updates.
Monitor App Store and enterprise app distribution channels for newly published apps that request device identification capabilities.

How to Mitigate CVE-2026-84612

Immediate Actions Required

Deploy the September 2026 Apple security updates to all managed Apple devices through MDM enforcement policies.
Restrict sideloading and enterprise app distribution on managed fleets until updates are confirmed installed.
Audit third-party applications for unnecessary access to device identification APIs and remove untrusted apps.

Patch Information

Apple resolved CVE-2026-84612 in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. Refer to the corresponding Apple Support advisories for platform-specific release notes and installation guidance. Given the local attack vector and requirement for user interaction, prioritization can follow standard mobile patch cadence, with expedited rollout for devices handling sensitive workloads.

Workarounds

Enforce installation of applications only from the official App Store through MDM configuration profiles.
Revoke unused enterprise developer certificates and disable sideloading on supervised devices.
Educate users to avoid installing apps from untrusted sources or unfamiliar TestFlight invitations until patching is complete.

bash

# Example MDM restriction payload keys to enforce App Store-only installs
# PayloadType: com.apple.applicationaccess
allowAppInstallation = true
allowUIAppInstallation = true
allowEnterpriseAppTrust = false
allowAppRemoval = true