CVE-2026-84555

Executive Summary

CVE-2026-84555 is an authorization flaw (CWE-284: Improper Access Control) in Apple macOS that "was addressed with improved access control." Per the NVD description, "An app may be able to access sensitive user data" following user interaction. The vulnerability is rated CVSS 5.5 (Medium) with a local attack vector and High confidentiality impact, and affects macOS Sequoia versions prior to 15.8 and macOS Golden Gate versions prior to 27. No public proof-of-concept, exploit code, or Nuclei template exists, and the EPSS score is 0.00119 (2.0 percentile), indicating no observed exploitation activity in the wild.

Technical Analysis

CVE-2026-84555 is classified under CWE-284 (Improper Access Control), a broad category encompassing failures to correctly enforce authentication, authorization, or permission boundaries. The NVD description is deliberately terse — a common attribute of Apple security advisories — and states only that an authorization issue "was addressed with improved access control" and that "An app may be able to access sensitive user data."

Because macOS enforces data separation through layered mechanisms — the sandbox, Transparency, Consent, and Control (TCC) privacy framework, entitlement validation, and per-process authorization checks — a CWE-284 defect of this class typically means the operating system granted an application access to a resource that the user had not explicitly authorized, or that an app was able to bypass a consent boundary it should have respected. The phrase "improved access control" is Apple's standard language for a missing or incorrect authorization check that was corrected by tightening the policy governing which processes may read a protected resource.

The CVSS v3.1 vector provides the only additional reliable technical signal:

• AV:L (Local) — the attacker cannot trigger the flaw remotely; they require a foothold on the host (a local process, a sandboxed application, or code already executing in a user context).
• AC:L (Low) — no special preconditions or race windows beyond normal execution are required.
• PR:N (None) — no privileges are required prior to the attack; an unprivileged app can attempt it.
• UI:R (Required) — the victim must perform some action, consistent with an application being launched or a consent prompt being engaged.
• S:U (Unchanged) — the compromise remains within the security authority of the vulnerable component.
• C:H / I:N / A:N — the sole impact is high confidentiality loss: unauthorized read of sensitive user data. No integrity or availability impact is expected.

The affected versions span two release trains — the older Sequoia branch (fixed at 15.8) and the newer "Golden Gate" branch (fixed at 27) — indicating the flaw persisted across an OS release boundary and required coordinated fixes. Notably, the very existence of a "macOS Golden Gate 27" fix reference is anomalous relative to current public Apple release naming and should be treated as unverified pending vendor confirmation, consistent with the low patch-confidence rating (2/4 CLAIMED, NVD as single source).

No affected package list, OSV package mapping, function names, file paths, entitlement identifiers, or subsystem names are provided in the source data. Accordingly, no code-level detail can be asserted without fabrication. The authoritative statement of scope remains the NVD description alone.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, because no public PoC, exploit code, or detailed advisory exists. The chain is inferred from CWE-284, the CVSS vector, and the NVD description's statement that "an app may be able to access sensitive user data."

1. Reconnaissance / target identification. Because the attack is local (AV:L), the adversary first establishes a position on the macOS host — for example, by delivering a malicious or trojanized application the user chooses to run (UI:R), or by leveraging an existing foothold. The attacker identifies that the target runs an affected macOS Sequoia build (< 15.8) or an affected Golden Gate build (< 27).

2. Triggering the authorization flaw. The malicious application executes and attempts to access a protected class of sensitive user data. Due to the improper access-control check described by Apple, the request is not correctly denied — the app is instead granted access it was not authorized to receive. No privilege escalation is needed (PR:N); the flaw is one of authorization logic rather than privilege enforcement, so the app reaches the resource in its ordinary (unprivileged) execution context.

3. Payload / execution method (class level). At the vulnerability-class level, exploitation requires only that the application request the protected resource and that the user interaction component of the vector (UI:R) have occurred. The mechanism is a bypass of a consent/authorization gate rather than memory corruption, injection, or a remotely reachable endpoint. No specific API, entitlement, endpoint, or system call should be assumed; none is disclosed.

4. Post-exploitation impact. Successful exploitation yields confidentiality loss (C:H) only: unauthorized read of sensitive user data. The benefit to an attacker is collection of that data with no need for elevated privileges. There is no integrity or availability impact, and the scope remains unchanged (S:U). The practical value is exfiltration of user data accessible to an unprivileged app that should have been blocked by the intended access control.

No public PoC or exploit is available; the chain above is inferred strictly from the vulnerability class and CVSS vector. Any claim of specific functions, files, or data objects would be speculative and is deliberately excluded.

Impact Assessment

• Business impact: Loss of sensitive user data confidentiality from a locally installed application. For enterprises, the principal risk is unauthorized exfiltration of user data by macOS applications that users run on managed endpoints, without requiring administrative privileges.
• Affected systems: macOS Sequoia (versions before 15.8) and macOS Golden Gate (versions before 27), per the fix references in the NVD record.
• Blast radius: Limited to the individual host — the vector is Local (AV:L) and Scope is Unchanged (S:U). There is no remote or lateral movement vector described. Impact is confined to the confidentiality of data the host's user is authorized to see.
• CVSS subscore reasoning: Confidentiality High (C:H) reflects direct access to sensitive user data; Integrity None (I:N) and Availability None (A:N) reflect that the flaw does not permit data tampering or denial of service.
• Exploitation likelihood: Low. No public exploit, no observed campaign, and EPSS 0.00119 (2.0 percentile) indicate negligible near-term exploitation pressure. Absence from CISA KEV reinforces this.
• Caveat: Patch confidence is 2/4 (CLAIMED, NVD-only, not independently confirmed); the affected-version range is derived solely from the fixed-version references and should be validated against the vendor advisory before making deployment decisions.

Detection Guidance

Detection is challenging because exploitation is local and involves no network signature. The rules below are behavioral heuristics at the vulnerability-class level; deterministic detection requires the vendor's confidentiality note and specific subsystem detail, which are not available. Use these as low-confidence corroborating signals, not proof of exploitation.

Sigma Rule

title: Suspicious macOS Application Access to Protected User Data (CVE-2026-84555 heuristic)
id: 7b2c1f84-9a3e-4d51-b0c6-8f5e2a1d9c40
status: experimental
description: Detects process executions consistent with an unauthorized macOS application accessing protected user data, as described for CVE-2026-84555 (CWE-284). Low-confidence behavioral heuristic.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84555
author: valtersit.com
date: 2026-01-01
tags:
  - attack.collection
  - attack.t1074
logsource:
  product: macos
  category: process_creation
detection:
  selection_tcc:
    Image|endswith:
      - '/tccd'
    CommandLine|contains:
      - 'access'
  selection_appdata:
    Image|startswith: '/Applications/'
    CommandLine|contains:
      - 'Library/'
  condition: selection_tcc or selection_appdata
falsepositives:
  - Legitimate applications accessing user-selected files via normal consent flow
  - Backup and synchronization software
level: low

YARA Rule

rule CVE_2026_84555_macOS_AccessControl_Heuristic
{
    meta:
        description = "Heuristic for macOS binaries attempting unauthorized access to protected user data (CVE-2026-84555). Low confidence; no known exploit sample."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84555"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $macho = { FE ED FA CE }
        $macho64 = { FE ED FA CF }
        $tcc = "TCCAccessRequest" ascii
        $privacy = "kTCCService" ascii
        $lib = "Library/Application Support" ascii
    condition:
        ($macho at 0 or $macho64 at 0) and 1 of ($tcc, $privacy, $lib)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-84555 macOS Authorization Bypass - Suspicious App Data Harvesting Network Exfil"; flow:established,to_server; content:"|50 4f 53 54|"; http_method; content:"Content-Type|3a 20|application/octet-stream"; http_header; content:"Library"; http_uri; threshold:type both, track by_src, count 5, seconds 60; classtype:trojan-activity; sid:9004555; rev:1; reference:cve,2026-84555;)

Note: CVE-2026-84555 is a local authorization flaw with no network exploit path; this rule targets post-exploitation exfiltration of harvested user data and is a compensating control only.

Elastic Detection

process where event.type == "start" and event.action == "exec" and
  process.executable : ("/Applications/*") and
  process.command_line : "*Library/Application Support*" and
  process.parent.name in ("Finder", "launchd", "bash", "zsh")

Correlate with host-based TCC decision logging to reduce false positives.

Splunk SPL Query

index=macos sourcetype=osquery:results OR sourcetype=macos_unified_logs
(process_name=* OR Image=*)
("TCC" OR "kTCCService" OR "access request")
NOT (SignatureStatus="valid" AND TeamID="apple")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as images values(User) as users by host
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="macos,cve-2026-84555,">
  <rule id="100555" level="6">
    <if_sid>60000</if_sid>
    <field name="process.name">\.app/Contents/MacOS/</field>
    <field name="process.command_line">Library/(Application Support|Preferences|Keychains)</field>
    <description>CVE-2026-84555 heuristic: macOS application accessed protected user data path without authorized consent</description>
    <mitre>
      <id>T1074</id>
    </mitre>
    <group>access_control_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The only patch source is NVD; the vendor advisory has not been independently confirmed here. Validate against Apple's official security releases before deployment.

1. Immediate mitigations (interim controls):

   • Enforce application allowlisting (e.g., Notarization + MDM policy) so only vetted, signed applications execute on managed macOS endpoints, reducing the opportunity for an unauthorized app to trigger the flaw.
   • Reduce user-initiated launches of unsigned or untrusted applications; educate users on treating unexpected app prompts as suspicious.
   • Monitor TCC/privacy decision logs for anomalous grants, and investigate applications that suddenly gain access to broad user-data classes.
   • Because there is no network attack surface and no PoC, prioritize these controls by exposure rather than urgency.

2. Patch / upgrade steps:

   • Upgrade affected hosts to macOS Sequoia 15.8 or macOS Golden Gate 27 (per the NVD fix references).
   • Use MDM (Jamf, Kandji, Intune) to schedule and enforce updates; verify build numbers post-update.
   • Given the 2/4 patch confidence, cross-check the fixed-version numbers against Apple's official advisory before closing the finding.

3. Long-term hardening:

   • Maintain a rapid patch cadence for OS-level privacy/authorization fixes.
   • Harden the TCC and sandbox posture: least-privilege entitlements for internal apps, and periodic review of privacy entitlements.
   • Deploy endpoint detection with behavioral coverage for unauthorized sensitive-data access (collection behaviors, T1074 Data Staged).
   • Track CVE-2026-84555 in patch-management inventory despite low EPSS, since local authorization flaws can be chained with other primitives.

References

1. NVD — CVE-2026-84555: https://nvd.nist.gov/vuln/detail/CVE-2026-84555
2. CWE-284 — Improper Access Control: https://cwe.mitre.org/data/definitions/284.html
3. Apple Security Releases (vendor advisory index — verify fixed versions 15.8 / Golden Gate 27): https://support.apple.com/en-us/HT201222
4. FIRST — EPSS model and scoring: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84555 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. No public proof-of-concept, no exploit code, no Nuclei template, and no CISA KEV listing. EPSS 0.00119 (2.0 percentile) indicates no observed exploitation activity. The affected-version range and patch versions are derived solely from NVD and remain unconfirmed pending vendor validation.