CVE-2026-84560

Executive Summary

CVE-2026-84560 is an authorization weakness (CWE-863) in Apple's operating system family — including iPadOS — where "an app may gain unauthorized access to Bluetooth." The flaw was addressed via "improved state management" and is fixed in the version 27 release train (iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27). Impact is confined to a local attack vector requiring an already-installed app on the victim device, producing a confidentiality gain of low severity and an integrity impact of high severity, yielding a CVSS base score of 6.1 (Medium). No public PoC, no Nuclei template, and no CISA KEV listing exist as of this writing; EPSS is 0.00140 (3.8th percentile), indicating low predicted exploitation activity in the wild.

Technical Analysis

The vulnerability class is CWE-863: Incorrect Authorization — a logic flaw in access-control enforcement rather than a memory-safety bug. The NVD description is terse: "An authorization issue was addressed with improved state management." This phrasing from Apple's security notes indicates that the underlying defect is a failure to correctly track or transition some permission/authorization state, so that an application can end up operating with Bluetooth-related capabilities it should not hold.

The affected attack surface is the Bluetooth permission/authorization subsystem of Apple's operating systems. Apple platforms gate Bluetooth access behind user-visible privacy controls (Bluetooth permission prompts and the associated per-app authorization state). An application that has already been installed and executed locally (the required privilege, PR:L) can, according to the description, attain unauthorized Bluetooth access. Because the flaw is described as a state-management defect rather than a memory-corruption issue, the practical consequence is an improper grant of Bluetooth capability: the app can reach Bluetooth functionality without the user having approved it, or beyond the scope of the approval the user did give.

Two CVSS subscores define the mechanism's boundaries:

• Confidentiality: Low (C:L) — the unauthorized access yields limited disclosure of information reachable through the Bluetooth interface.
• Integrity: High (I:H) — the more significant property is that the app can do something with Bluetooth it is not authorized to do (e.g., interact with Bluetooth state, connections, or data paths), which is an integrity violation of the security control.
• Availability: None (A:N) — no denial-of-service is implied.

AV:L and UI:N indicate no user interaction is required beyond having the app present and running; the local attacker model is that of a malicious or compromised app on the device. No details about specific API symbols, entitlement names, daemon identifiers, or Bluetooth profiles involved are provided in the source data, and none are asserted here.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred at the vulnerability-class level from the NVD description. No specific function names, API paths, entitlements, or profile identifiers are invented.

1) Reconnaissance / target identification. The attacker targets Apple devices (iPhone/iPad/Mac/Apple TV/Vision Pro/Apple Watch) that have not been updated to the version 27 release of their respective OS and that can be induced to install an application — via a malicious App Store listing (where it would, absent this bug, be denied or prompted for Bluetooth access), sideloading, enterprise/MDM distribution, or a compromised legitimate app. Identification is therefore largely a matter of OS version fingerprinting and app-delivery channels rather than remote network scanning; Shodan-based reconnaissance is not applicable to this local, permission-logic flaw.

2) Triggering the flaw. The core requirement is that the malicious app executes on the vulnerable device. Exploitation then abuses the incorrect authorization state: because of a state-management defect, the app obtains Bluetooth access that the user did not authorize. At the class level, an attacker would attempt to invoke Bluetooth operations and observe that access is granted in a context where the platform's permission state should have denied or gated it. The precise trigger sequence is not described in the available data.

3) Payload / execution method. The "payload" is the malicious application itself, delivered through normal app-distribution channels. No payload format, code pattern, or injection primitive is disclosed. The exploitation primitive is an authorization bypass, i.e., an operation proceeds that the access-control logic should have blocked.

4) Post-exploitation impact. With unauthorized Bluetooth access, the app has an out-of-policy channel/interface. Consequences map to the CVSS impact: limited information exposure (C:L) and a meaningful integrity violation (I:H) of the platform's privacy/authorization control. Possible downstream uses — such as interacting with Bluetooth state, communicating with or enumerating nearby Bluetooth entities, or using Bluetooth as a covert data path — are consistent with an unauthorized-access-to-Bluetooth primitive, but the source data does not enumerate specific capabilities and none are claimed here. There is no evidence of a wider persistence or lateral-movement chain specific to this CVE.

Impact Assessment

The blast radius is limited to local, unprivileged, already-installed applications on affected Apple devices. It is not a remotely reachable, pre-auth, or network-exploitable issue: AV:L, PR:L, and UI:N make clear that the attacker must already have code running. This substantially narrows the realistic threat to malicious apps, trojanized applications, or a compromised component of the local app ecosystem — including apps that would otherwise be denied Bluetooth access.

Business relevance:

• Privacy/compliance: Unauthorized Bluetooth access undermines user-consent controls, which is business-relevant for organizations subject to privacy regimes governing device sensors and wireless interfaces.
• Enterprise-managed fleets: Managed iOS/iPadOS/macOS deployments that permit third-party apps inherit the risk until updated to version 27.
• Integrity framing: The High integrity subscore reflects that the security control itself (the authorization decision) is being violated — the app acts in a way the platform intended to forbid.

The EPSS of 0.00140 (3.8th percentile) and the absence of KEV/PoC/exploit activity indicate low near-term exploitation probability, but the flaw is one of many Apple privacy/authorization fixes that become more attractive to attackers as details surface. Overall severity is Medium (6.1); because it is local and requires app installation, it is unlikely to be weaponized as a standalone attack and is more plausible as a component of a malicious-app or multi-stage chain.

Detection Guidance

Because this is a local authorization flaw with no network signature in the source data, detection is primarily endpoint/telemetry-based — monitoring for anomalous Bluetooth access patterns and for devices remaining on pre-27 OS versions. The rules below are heuristic detections for the class of behavior (unauthorized Bluetooth access by apps) and should be tuned to your fleet; they do not rely on any undisclosed technical artifact.

Sigma Rule

title: Suspected Unauthorized Bluetooth Access by Application (CVE-2026-84560 Class)
id: 8f1c2a44-9b7e-4d21-a6f0-84560cve2026
status: experimental
description: Detects application processes accessing Bluetooth resources without a corresponding user-granted Bluetooth permission context on Apple platforms, consistent with CWE-863 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84560
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: macos
detection:
  selection_bt:
    CommandLine|contains:
      - 'bluetooth'
      - 'CoreBluetooth'
      - 'IOBluetooth'
  selection_unsigned:
    Signed|contains: 'false'
  condition: selection_bt and selection_unsigned
falsepositives:
  - Legitimate Bluetooth utility applications
  - Development and debugging tools
level: medium
tags:
  - attack.t1078
  - cve.2026.84560

YARA Rule

rule CVE_2026_84560_Bluetooth_AuthBypass_Indicators
{
    meta:
        description = "Heuristic indicators for Apple apps attempting unauthorized Bluetooth access (CVE-2026-84560), CWE-863"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84560"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $bt1 = "CoreBluetooth" ascii wide
        $bt2 = "CBCentralManager" ascii wide
        $bt3 = "CBPeripheralManager" ascii wide
        $bt4 = "CBCentralManagerDelegate" ascii wide
        $ent = "com.apple.security.device.bluetooth" ascii wide

    condition:
        uint32be(0) == 0xFEEDFACF or uint32be(0) == 0xCAFEBABE or
        (5 of ($bt*)) or
        ($ent and any of ($bt*))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"LOCAL Possible CVE-2026-84560 Unauthorized Bluetooth Access Behavior (behavioral)"; flow:to_server; classtype:attempted-user; sid:20268456; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-84560; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84560;)

Elastic Detection

process where event.type == "start" and
  process.name like~ ("*Bluetooth*") and
  not process.code_signature.trusted == true

Splunk SPL Query

index=endpoint sourcetype=osquery:macos OR sourcetype=macos:unifiedlog
(process_name="*Bluetooth*" OR Message="*CoreBluetooth*" OR Message="*Bluetooth*")
NOT (signature_status="valid" OR System_Extension="true")
| stats count min(_time) as first_seen max(_time) as last_seen by host process_name user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="apple,bluetooth,cve-2026-84560,">
  <rule id="2026845" level="8">
    <decoded_as>json</decoded_as>
    <field name="process">\.*(Bluetooth|CoreBluetooth|IOBluetooth)\.*</field>
    <field name="signature_status">invalid|unsigned</field>
    <description>CVE-2026-84560: Possible unauthorized Bluetooth access by unsigned application (CWE-863)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_84560,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations

   • Apply strong app-review and mobile-threat-defense controls; restrict sideloading and unvetted enterprise app distribution, since exploitation requires a malicious/unauthorized app on the device.
   • Reduce Bluetooth reliance/attack surface on sensitive devices; disable Bluetooth where operationally feasible.
   • Enhance monitoring for anomalous Bluetooth access by unsigned or untrusted applications (see Detection Guidance).

2. Patch / upgrade steps

   • Upgrade to the fixed version-27 train: iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27 (per NVD). Confirm the update is installed on all managed devices before relaxing compensating controls.
   • Because the fix source is single-sourced and not independently confirmed, verify that the target build reflects the corrected authorization state management and re-test Bluetooth permission behavior.

3. Long-term hardening

   • Maintain aggressive, enforced OS patch SLAs for Apple fleets.
   • Enforce least-privilege MDM app policies and continuous app-signature validation.
   • Treat per-app privacy/authorization controls (Bluetooth and other sensors) as audited security boundaries; alert on deviations.

References

• NVD — CVE-2026-84560: https://nvd.nist.gov/vuln/detail/CVE-2026-84560
• NVD — CWE-863 (Incorrect Authorization): https://cwe.mitre.org/data/definitions/863.html
• Apple Security Releases (iOS/iPadOS/macOS/tvOS/visionOS/watchOS 27): https://support.apple.com/en-us/HT201222
• FIRST — EPSS (score 0.00140, 3.8th percentile): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of publication): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor / exploit-in-the-wild note: No CISA KEV listing, no public PoC, no exploit code, and EPSS of 0.00140 indicate no known in-the-wild exploitation or attributed campaign at the time of writing. Patch status is single-sourced (CLAIMED, 2/4 confidence) and should be independently validated.