CVE-2026-84628 Overview
CVE-2026-84628 is an authorization vulnerability affecting multiple Apple operating systems. The flaw allows a sandboxed application to access the System Keychain, breaking the isolation boundary that the App Sandbox is designed to enforce. Apple addressed the issue through improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. The vulnerability is categorized under [CWE-863: Incorrect Authorization].
Critical Impact
A sandboxed application can bypass authorization controls to read System Keychain contents, exposing credentials, cryptographic keys, and other sensitive secrets protected by the operating system.
Affected Products
- Apple iOS and iPadOS versions prior to 27
- Apple macOS versions prior to Golden Gate 27
- Apple tvOS, visionOS, and watchOS versions prior to 27
Discovery Timeline
- 2026-09-14 - CVE-2026-84628 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-84628
Vulnerability Analysis
The vulnerability resides in the authorization logic that governs keychain access requests on Apple platforms. The System Keychain stores system-wide secrets that should remain inaccessible to unprivileged, sandboxed processes. Due to improper state management, the authorization check fails to correctly evaluate whether a sandboxed caller has permission to read System Keychain items. An attacker who can execute code inside a sandboxed application on the device can leverage this flaw to reach credentials outside the sandbox boundary. Apple's advisory attributes the fix to improved state management within the authorization pathway.
Root Cause
The root cause is incorrect authorization ([CWE-863]) driven by inconsistent state tracking during keychain access mediation. The system did not reliably preserve the sandbox context of the requesting process when evaluating entitlement to System Keychain items. This state confusion allowed a check that should have denied access to succeed instead.
Attack Vector
Exploitation requires local code execution inside a sandboxed application and user interaction, consistent with a scenario in which a user installs or runs a malicious or compromised app. The attacker does not need elevated privileges before triggering the flaw. Successful exploitation results in disclosure of System Keychain contents without altering integrity or availability. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The CISA Known Exploited Vulnerabilities catalog does not list this CVE.
Apple has not published low-level technical details. See the vendor advisories, including Apple Support Document #149034 and Apple Support Document #149037, for the authoritative description.
Detection Methods for CVE-2026-84628
Indicators of Compromise
- Sandboxed applications making unexpected calls to SecItemCopyMatching or related Security framework APIs targeting System Keychain access groups.
- Presence of applications on managed devices that remain on OS builds earlier than iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27.
- Anomalous outbound network traffic from sandboxed apps following keychain API activity, indicating potential exfiltration of harvested secrets.
Detection Strategies
- Inventory endpoint OS versions through mobile device management (MDM) tooling and flag devices running pre-patch releases.
- Review App Sandbox entitlements and code-signing metadata for installed third-party applications, prioritizing apps requesting keychain-related entitlements they do not require.
- Correlate Endpoint Security framework events on macOS with process ancestry to identify sandboxed processes performing sensitive Security framework operations.
Monitoring Recommendations
- Enable unified logging subsystems related to securityd and trustd on macOS to capture keychain access decisions for later review.
- Track application installations and updates from outside the App Store or approved MDM catalogs.
- Monitor for credential reuse events on enterprise services that could indicate secrets harvested from device keychains.
How to Mitigate CVE-2026-84628
Immediate Actions Required
- Update all Apple devices to iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, or watchOS 27 as applicable.
- Enforce the minimum patched OS build through MDM compliance policies and block noncompliant devices from accessing corporate resources.
- Audit third-party applications with keychain entitlements and remove any that are unnecessary or untrusted.
Patch Information
Apple released fixes across the affected platforms. Refer to the vendor advisories for exact build numbers and installation guidance: Apple Support Document #149034, Apple Support Document #149035, Apple Support Document #149036, Apple Support Document #149037, and Apple Support Document #149038.
Workarounds
- No vendor-supplied workaround exists. Patching is the only supported remediation.
- Restrict installation of untrusted applications by enforcing App Store or MDM-approved deployment channels until affected devices are updated.
- Rotate high-value credentials stored in the System Keychain after patching devices that may have run untrusted sandboxed applications.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
