← Advisories
CVE-2026-84559
CoreServices permissions issue allows a malicious application to access restricted files
- Vendor
- Apple
- Component
- CoreServices
- Severity
- 5.5 Medium
- Status
- Fixed
Apple’s advisory
Apple published this issue on 14 September 2026 under the CoreServices component.
Impact. A malicious application may be able to access restricted files.
Description. A permissions issue was addressed with improved validation.
Fixed in
- macOS Golden Gate 27
- macOS Tahoe 26.7
- macOS Sequoia 15.8
Credit
Apple’s published credit line for this entry reads: Ryan Hughes.
Apple’s Security Research portal records this CVE against our report OE1107685948017, reported 3 September 2026 and addressed in macOS Golden Gate 27. The published advisory does not currently carry that credit; we have asked Apple to add it.
References
- NVD entry for CVE-2026-84559 (CVSS 3.1 5.5 Medium,
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-693) - Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
- Apple: About the security content of macOS Sequoia 15.8
This page reproduces Apple’s published advisory. The technical write-up is published separately at merrickhare.com. No proof-of-concept code is published for this issue.