CVE-2026-84624: Apple iOS/macOS Path Traversal Vulnerability

CVE-2026-84624 Overview

CVE-2026-84624 is a permissions vulnerability in multiple Apple operating systems caused by improper path validation. A sandboxed application can leverage the flaw to access restricted files outside its sandbox boundary. Apple addressed the issue by improving path validation across affected platforms. The weakness is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Exploitation requires local access and user interaction, limiting remote attack scenarios but remaining relevant for malicious apps distributed through side-channels or supply-chain compromise.

Critical Impact
A sandboxed app may bypass filesystem restrictions and read files it should not have permission to access, potentially exposing sensitive user data.

Affected Products

iOS and iPadOS versions prior to 26.7 and 27
macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27
visionOS prior to 27

Discovery Timeline

2026-09-14 - CVE-2026-84624 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84624

Vulnerability Analysis

The vulnerability resides in Apple's sandbox enforcement logic, where path validation routines fail to properly canonicalize or verify filesystem paths supplied by sandboxed processes. A sandboxed application can craft path references that evade the sandbox profile checks and resolve to files outside the allowed container. The result is unauthorized read access to restricted files, which may include user documents, application data, or system resources normally protected by sandbox entitlements. Apple resolved the issue by strengthening path validation in the affected components.

Root Cause

The root cause is improper path validation ([CWE-22]) in the sandbox enforcement layer. The sandbox trusts path inputs without fully resolving symbolic links, relative components, or edge-case encodings before applying access control decisions. This allows a sandboxed process to reference resources outside its permitted filesystem view.

Attack Vector

Exploitation requires local execution of a malicious or compromised sandboxed application and some form of user interaction. An attacker must first deliver an application to the target device, typically through the App Store, TestFlight, enterprise provisioning, or developer channels. Once running, the app issues filesystem operations with crafted paths to reach restricted files. Network-based exploitation is not applicable because the attack vector is local.

No verified proof-of-concept code is publicly available. See the Apple Support advisories for vendor-provided technical context.

Detection Methods for CVE-2026-84624

Indicators of Compromise

Sandboxed applications making filesystem calls that reference paths containing suspicious relative components (../), unusual symlink chains, or paths outside their declared container.
Unexpected reads of user data files, keychain-adjacent directories, or system configuration files by third-party apps.
Applications requesting entitlements or performing filesystem enumeration inconsistent with their declared functionality.

Detection Strategies

Monitor Apple Endpoint Security framework events (ES_EVENT_TYPE_NOTIFY_OPEN, ES_EVENT_TYPE_NOTIFY_READLINK) for sandboxed processes accessing paths outside their container.
Correlate process code-signing identity and sandbox entitlements against observed filesystem access patterns to identify boundary violations.
Review MDM and application inventory data to flag installed apps that have not been updated to patched OS versions.

Monitoring Recommendations

Enforce OS version baselines through mobile device management and alert when endpoints fall behind Apple's patched releases.
Ingest macOS Unified Log and Endpoint Security telemetry into a centralized analytics platform for retroactive hunting.
Track newly installed applications from non-App Store sources and prioritize them for behavioral review.

How to Mitigate CVE-2026-84624

Immediate Actions Required

Update all Apple devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, or visionOS 27.
Audit installed third-party applications and remove any that are unnecessary, unmaintained, or from untrusted developers.
Restrict installation of enterprise-signed or side-loaded applications through MDM policy.

Patch Information

Apple released fixes in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27. Refer to the vendor advisories for platform-specific details: Apple Support #149034, #149035, #149038, #149041, #149042, and #149043.

Workarounds

No vendor-supplied workaround exists; applying the patched OS release is the only complete remediation.
Limit installation of untrusted applications and disable enterprise-signed app installation where not required.
Enable automatic OS updates on managed fleets to reduce exposure windows for future sandbox-related issues.

bash

# Verify installed macOS build version
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart