Is CVE-2026-84609 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84609 being exploited in the wild.

How severe is CVE-2026-84609?

Critical severity, with a CVSS score of 9.8, published 14 September 2026.

Which products and versions are affected?

Apple iPadOS 27; Apple macOS Golden Gate 27; Apple macOS Sequoia 15.8; Apple macOS Tahoe 26.7; and 3 more.

Is there a fix for CVE-2026-84609?

A patch was published on 2026-09-14: Patches released for iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84609 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-84609?

Check whether you run Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84609: Apple iOS APFS permissions bypass in path validation

CVE-2026-84609 · Severity: critical · CVSS 9.8 · Published 2026-09-14

Apple's iOS and related operating systems contain a permissions validation flaw in the APFS filesystem that allows applications to modify protected system files. An attacker controlling a malicious app could gain unauthorized access to critical system files, potentially compromising device security, user data, and system integrity across multiple Apple platforms including iPhones, iPads, and Macs.

Technologies: Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia, Apple Tvos, Apple Visionos, Apple watchOS. Vendors: Apple.

Quick answers

Is CVE-2026-84609 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84609 being exploited in the wild.
How severe is CVE-2026-84609?: Critical severity, with a CVSS score of 9.8, published 14 September 2026.
Which products and versions are affected?: Apple iPadOS 27; Apple macOS Golden Gate 27; Apple macOS Sequoia 15.8; Apple macOS Tahoe 26.7; and 3 more.
Is there a fix for CVE-2026-84609?: A patch was published on 2026-09-14: Patches released for iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84609 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-84609?: Check whether you run Apple iPadOS, Apple macOS Golden Gate, Apple macOS Sequoia or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A permissions issue exists in APFS (Apple File System) where inadequate path validation allows applications to bypass restrictions on system file access. The vulnerability is addressed through improved path validation logic. An app can leverage this flaw to write to protected system files without proper authorization checks. The issue affects multiple platforms including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Patches were released on September 14, 2026 across all affected platforms.

Affected products

Apple iOS 27
Apple iPadOS 27
Apple macOS Golden Gate 27
Apple macOS Sequoia 15.8
Apple macOS Tahoe 26.7
Apple tvOS 27
Apple visionOS 27
Apple watchOS 27

Timeline

2026-09-14: disclosed: CVE-2026-84609 disclosed alongside iOS 27, iPadOS 27, and macOS updates
2026-09-14: patched: Patches released for iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.