CVE-2026-86891: Apple macOS Authorization Bypass Vulnerability

CVE-2026-86891 Overview

CVE-2026-86891 is an authorization vulnerability affecting Apple macOS and watchOS. An application can access Bluetooth device information without proper authorization. Apple addressed the issue through improved state management in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and watchOS 27.

The flaw is categorized under [CWE-285] (Improper Authorization). Exploitation requires adjacent network access and low privileges, and it impacts confidentiality of Bluetooth device metadata. The vulnerability does not affect integrity or availability, and no public exploit is currently available.

Critical Impact
A local application may access Bluetooth device information belonging to paired or nearby devices, exposing device identifiers and metadata to unauthorized processes.

Affected Products

Apple macOS Golden Gate (prior to 27)
Apple macOS Sequoia (prior to 15.8) and macOS Tahoe (prior to 26.7)
Apple watchOS (prior to 27)

Discovery Timeline

2026-09-14 - CVE-2026-86891 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-86891

Vulnerability Analysis

The vulnerability resides in the authorization logic governing access to Bluetooth device information within Apple's operating systems. An application running on an affected device can bypass access controls and enumerate Bluetooth device data. The issue is classified as Improper Authorization ([CWE-285]).

According to Apple's advisories, the root problem was addressed with improved state management. This indicates that the authorization decision depended on state that could be manipulated or misinterpreted, allowing an unauthorized application to obtain data intended for privileged callers.

The exposed information includes Bluetooth device identifiers, connection state, and related metadata for paired or discoverable devices. This data can enable device fingerprinting, user tracking, and reconnaissance for follow-on attacks against nearby peripherals.

Root Cause

The root cause is inconsistent authorization state tracking within the Bluetooth subsystem. The affected component failed to enforce entitlement or permission checks under specific state transitions, permitting queries from applications lacking the Bluetooth access grant.

Attack Vector

Exploitation requires code execution on the affected device through an installed application. The attacker's application queries Bluetooth interfaces that should be gated by user consent or entitlement checks. Because the attack vector is adjacent network, the attacker must be within Bluetooth range of target peripherals to observe meaningful device information.

No public proof-of-concept or exploit code has been released. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-86891

Indicators of Compromise

Unexpected applications requesting or accessing Bluetooth APIs without a corresponding user consent prompt.
Anomalous Bluetooth scanning activity originating from processes that do not require Bluetooth connectivity for their stated function.
Log entries in bluetoothd or CoreBluetooth showing repeated device enumeration from unprivileged processes.

Detection Strategies

Audit installed applications on macOS and watchOS for those declaring or invoking Bluetooth entitlements outside their expected scope.
Review Transparency, Consent, and Control (TCC) database entries to identify applications that gained Bluetooth access without administrative approval.
Correlate process telemetry with Bluetooth framework calls to detect unauthorized enumeration attempts.

Monitoring Recommendations

Collect and centralize macOS Unified Log events tagged with the com.apple.bluetooth subsystem for retrospective analysis.
Monitor endpoint telemetry for unsigned or newly installed applications that access CoreBluetooth interfaces.
Alert on installations of applications that request Bluetooth entitlements from non-Apple developer sources.

How to Mitigate CVE-2026-86891

Immediate Actions Required

Upgrade all affected Apple devices to macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or watchOS 27 as applicable.
Inventory installed applications with Bluetooth permissions and revoke access for any that do not require it.
Restrict application installation to trusted developers and verified sources through mobile device management (MDM) policies.

Patch Information

Apple has released patches through the following advisories: Apple Support Article #149035, Apple Support Article #149037, Apple Support Article #149042, and Apple Support Article #149043. Administrators should deploy the applicable update to every managed endpoint.

Workarounds

Disable Bluetooth on devices where it is not required until patches are deployed.
Use MDM configuration profiles to deny Bluetooth entitlements to non-essential third-party applications.
Restrict device pairing to trusted peripherals and remove stale paired devices from system settings.

bash

# Verify macOS version to confirm patch level
sw_vers -productVersion

# List applications with Bluetooth access via TCC (requires Full Disk Access)
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "SELECT client FROM access WHERE service='kTCCServiceBluetoothAlways';"