CVE-2026-84612 in iOS
Summary
by MITRE • 09/15/2026
An authorization issue was addressed with improved access control. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to read persistent device identifiers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The disclosed vulnerability represents a critical failure in the operating system's authorization mechanisms, specifically within the access control logic governing application permissions for sensitive hardware and software resources. This issue allows an unauthorized application to bypass standard security boundaries that are designed to isolate app data from other applications and core system components. The root cause lies in insufficient validation of identity or privilege levels when handling requests related to persistent device identifiers. In modern mobile and desktop operating systems, such as iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, strict sandboxing is enforced to prevent apps from accessing data belonging to other entities unless explicit user consent or system-level privileges are granted. The flaw in this implementation means that the check for whether an app has legitimate authorization to access these identifiers was either missing, incorrectly implemented, or easily circumvented through specific API calls or state manipulation techniques.
Persistent device identifiers serve as unique strings assigned to a hardware unit, often used by developers and advertisers to track user behavior across sessions without requiring explicit login credentials. These identifiers are considered sensitive personal data under many privacy regulations because they can be linked back to an individual's digital footprint over time. When an application is able to read these identifiers without proper authorization, it compromises the principle of least privilege. The attacker or malicious actor does not need to exploit a complex memory corruption bug or gain kernel-level access; instead, they leverage a logical flaw in how the operating system validates app entitlements. This type of vulnerability falls squarely under CWE-269, which classifies Improper Privilege Management, and more specifically relates to CWE-732, where an application performs authorization checks incorrectly. The ability to extract these identifiers effectively breaks the isolation model that protects user privacy on Apple's platforms.
The operational impact of this vulnerability is significant for both end-users and enterprise environments relying on secure device management. If a malicious app can successfully retrieve persistent device identifiers, it enables long-term tracking of users across different applications and services. This capability facilitates sophisticated profiling activities where an adversary can build detailed behavioral profiles based on usage patterns, location history inferred from app interactions, and other metadata associated with the identifier. In enterprise settings, this could allow for unauthorized correlation of employee activity data or facilitate targeted phishing campaigns by linking device identity to specific organizational accounts. Furthermore, it undermines trust in the platform's security model, as users expect that apps running on their devices are confined to their designated sandboxes and cannot exfiltrate unique hardware signatures without explicit permission.
Mitigation strategies primarily involve applying the software updates provided by Apple for iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. These updates contain the necessary code changes to enforce stricter access controls on APIs responsible for returning persistent device identifiers. For developers, it is imperative to audit applications that request or utilize such identifiers to ensure they are using approved methods like Advertising Identifier (IDFA) with proper user consent mechanisms rather than attempting to access lower-level hardware IDs directly. Security teams should also monitor application behavior for unusual attempts to query system information and enforce mobile device management policies that restrict the installation of unverified apps from unknown sources, thereby reducing the attack surface available to exploit this logical flaw until patches are deployed.