CVE-2026-84636: Apple iOS Authorization Bypass Vulnerability

CVE-2026-84636 Overview

CVE-2026-84636 is an authorization vulnerability affecting multiple Apple operating systems. A local application can bypass authorization checks and access sensitive user data due to improper state management. Apple addressed the issue through improved state management across iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.

The vulnerability is tracked under [CWE-285: Improper Authorization]. Exploitation requires local access with low privileges and no user interaction. The flaw impacts confidentiality of user data but does not affect system integrity or availability.

Critical Impact
A malicious application installed on an affected Apple device can read sensitive user data outside its authorized scope, enabling privacy violations and downstream credential or identity theft.

Affected Products

Apple iOS and iPadOS versions prior to 27
Apple tvOS and visionOS versions prior to 27
Apple watchOS versions prior to 27

Discovery Timeline

2026-09-14 - CVE-2026-84636 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84636

Vulnerability Analysis

CVE-2026-84636 stems from improper state management within an authorization pathway across Apple's operating systems. When the affected component evaluates access requests, inconsistent internal state permits an application to reach protected resources it should not have permission to read.

The issue is classified as [CWE-285: Improper Authorization]. An installed app leverages the flawed state transitions to read sensitive user data. Apple describes the fix as "improved state management," indicating the authorization logic now maintains consistent state through the full request lifecycle.

Because the flaw is local and requires an installed application, the practical attack surface centers on sideloaded apps, malicious apps that evade App Store review, or previously trusted applications that turn hostile.

Root Cause

The root cause is inconsistent authorization state during request processing. An authorization check evaluates against a state that does not reflect the true policy for the calling app. This gap allows the app to obtain data reserved for higher-privileged or explicitly consented contexts.

Attack Vector

The attack vector is local. An attacker must deliver and execute an application on the target device. Once running, the app issues requests through the vulnerable interface and receives sensitive user data. No user interaction is required beyond initial app installation and execution.

No public proof-of-concept code is available. Refer to Apple's advisories for platform-specific technical context: Apple Support Advisory #149034, Apple Support Advisory #149036, Apple Support Advisory #149037, and Apple Support Advisory #149038.

Detection Methods for CVE-2026-84636

Indicators of Compromise

Applications requesting or accessing user data categories that do not match their declared entitlements or purpose
Unexpected background activity from newly installed apps immediately after launch
Anomalous outbound network traffic from an app that correlates with reads of contacts, photos, location, or health data

Detection Strategies

Inventory installed apps across managed Apple devices and flag apps sideloaded outside the App Store or MDM catalog
Correlate mobile device management (MDM) telemetry with privacy access logs to identify apps accessing sensitive data classes without a business justification
Review App Privacy Reports on iOS and iPadOS for apps that access sensitive data at unusual frequencies

Monitoring Recommendations

Enforce MDM policies that report OS version compliance and alert on devices running iOS, iPadOS, tvOS, visionOS, or watchOS versions earlier than 27
Monitor egress traffic from mobile devices for exfiltration patterns tied to specific applications
Track privacy prompt denials and app removals as behavioral signals of user-observed abuse

How to Mitigate CVE-2026-84636

Immediate Actions Required

Update all Apple devices to iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 or later
Push the update through MDM to enforce compliance across the managed fleet
Audit installed applications and remove any that are unnecessary, unknown, or sourced outside sanctioned channels

Patch Information

Apple resolved CVE-2026-84636 through improved state management in the affected authorization code path. Fixed versions are iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. Consult the vendor bulletins for build numbers and per-platform notes: Apple Support Advisory #149034, Apple Support Advisory #149036, Apple Support Advisory #149037, and Apple Support Advisory #149038.

Workarounds

No vendor-supplied workaround exists; upgrading to the fixed OS version is the only supported remediation
Restrict app installation to the official App Store and MDM-approved catalogs until devices are updated
Revoke permissions for high-risk data categories from apps that do not require them

bash

# Verify device OS version on macOS management workstations against fleet inventory
# Example: query MDM API for devices below the fixed builds
curl -s -H "Authorization: Bearer $MDM_TOKEN" \
  "https://mdm.example.com/api/devices?os_version_lt=27" \
  | jq '.devices[] | {name, os, os_version, last_checkin}'