CVE-2026-84612

Executive Summary

CVE-2026-84612 is an authorization flaw (CWE-863) in Apple's iOS and iPadOS that allows a malicious application to read persistent device identifiers without proper user consent or entitlement checks. Affected systems include a broad matrix of Apple operating systems—iOS, iPadOS, macOS (three release trains), tvOS, visionOS, and watchOS—indicating a shared code component across platforms. The CVSS 3.1 base score is 5.5 (Medium), reflecting a local attack vector, low complexity, no privileges required, and required user interaction, with high confidentiality impact but no integrity or availability impact. The low EPSS score (0.00172, 6.9th percentile) and absence of public PoC or CISA KEV listing suggest limited observed exploitation in the wild; however, the cross-platform nature and identifier exposure warrant attention for privacy-sensitive and regulated environments.

Technical Analysis

The vulnerability is classified as CWE-863: Incorrect Authorization. Per the NVD description, an authorization issue was addressed with improved access control. The specific technical mechanism is that an application running on an affected Apple OS may be able to read persistent device identifiers—values intended to be restricted or gated behind user consent or entitlement checks. The flaw lies in insufficient access control enforcement, meaning the code path responsible for exposing device identifiers to third-party applications did not correctly validate the caller's authorization state. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the attack requires local execution within the victim's device context, no elevated privileges, but does require user interaction—typically installing or launching a malicious app. The scope is unchanged, so the vulnerability does not allow the attacker to affect resources beyond the vulnerable component. Notably, the patch spans nine distinct OS versions across six platforms, which strongly implies the root cause resides in a shared framework or library layer (e.g., a system service that brokers identifier access to third-party apps). No specific function names, API endpoints, or code paths are disclosed in the available NVD description; therefore, the precise implementation detail remains unconfirmed. The description does not state which identifiers are exposed, how long they persist, or whether the issue enables correlation of user activity across app sessions or devices.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class (CWE-863, incorrect authorization) and the CVSS vector. It avoids fabricating any function, endpoint, or parameter names not present in the source data.

1. Reconnaissance / target identification: The attacker identifies a target running an unpatched version of iOS, iPadOS, macOS, tvOS, visionOS, or watchOS from the affected version list. This is a local attack, so the attacker must first convince the victim to install a malicious application—delivered via phishing, a malicious profile, or a third-party app marketplace side-load.

2. Triggering the authorization flaw: Once the malicious app is installed and launched (satisfying the UI:R requirement), it invokes a system-provided interface intended to return device identifiers. Because of the incorrect authorization check, the app receives the identifier data despite lacking the user's consent or the required entitlement. The app runs with no special privileges (PR:N), so no jailbreak or privilege escalation is needed—only user interaction to install/execute the app.

3. Payload / execution method at the class level: The application simply calls the affected system service or API and captures the returned identifier values. No memory corruption, injection, or network exploitation is involved. The attack is a logic/access-control bypass executed from within the app sandbox.

4. Post-exploitation impact: The attacker obtains a persistent device identifier, enabling tracking and correlation of the device across sessions, apps, and potentially across reinstalls or restarts. In enterprise contexts, this can facilitate targeted follow-on activity, user profiling, or linkage of anonymized telemetry to a specific device. There is no confidentiality, integrity, or availability impact to other components (scope unchanged), and no data modification occurs—only unauthorized read access.

The absence of public exploit code means the practical exploitability depends on the attacker's ability to distribute a malicious app through a channel that reaches the victim and passes app review/notarization controls.

Impact Assessment

Business impact centers on privacy and tracking risk rather than system compromise. The CVSS subscores are:

• Confidentiality: High (C:H) — persistent device identifiers are exposed, which are typically considered sensitive because they enable long-term tracking.
• Integrity: None (I:N) — no data modification.
• Availability: None (A:N) — no denial of service.
• Attack Vector: Local (AV:L) — requires local execution.
• Attack Complexity: Low (AC:L) — no specialized conditions beyond app installation.
• Privileges Required: None (PR:N) — no elevated privileges.
• User Interaction: Required (UI:R) — victim must install or launch the malicious app.
• Scope: Unchanged (S:U) — impact confined to the vulnerable component.

The blast radius spans all affected OS families (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) until patched. For regulated industries (healthcare, finance, government) and BYOD enterprise environments, unauthorized access to persistent identifiers can violate privacy regulations (e.g., GDPR, CCPA) and erode user trust. Because exploitation requires local app execution, mass remote exploitation is unlikely; the EPSS score (0.00172) and lack of KEV listing support a lower likelihood of active exploitation. However, the identifier read could serve as a precursor or enabling step for more targeted attacks, and the cross-platform patch makes incomplete patching a real risk in mixed-device fleets.

Detection Guidance

Sigma Rule

title: Potential Apple Device Identifier Read via Unauthorized App (CVE-2026-84612)
id: 7b9c1a2e-3f4d-4e5a-9c6b-2d1e0f8a4c3b
status: experimental
description: Detects suspicious access to device identifier APIs by third-party applications on Apple platforms consistent with CVE-2026-84612 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84612
author: Threat Intelligence Team
date: 2026/01/01
logsource:
  product: macos
  category: process_creation
detection:
  selection_app:
    Image|endswith:
      - '/Contents/MacOS/'
  selection_entitlement:
    CommandLine|contains:
      - 'deviceIdentifier'
      - 'identifierForVendor'
  condition: selection_app and selection_entitlement
falsepositives:
  - Legitimate first-party Apple applications accessing device identifiers
level: low

YARA Rule

rule CVE_2026_84612_DeviceIdentifier_Access
{
    meta:
        description = "Detects binaries referencing device identifier access patterns associated with CVE-2026-84612"
        author = "Threat Intelligence Team"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84612"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "identifierForVendor" ascii wide
        $s2 = "deviceIdentifier" ascii wide
        $s3 = "persistentDeviceIdentifier" ascii wide
        $s4 = "uniqueDeviceID" ascii wide

    condition:
        uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE or
        (2 of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84612 Potential Device Identifier Exfiltration"; flow:established,to_server; http.user_agent; content:"CFNetwork"; http.request_body; content:"deviceIdentifier"; nocase; classtype:policy-violation; sid:202684612; rev:1; metadata:affected_product Apple_iOS_iPadOS, cve CVE-2026-84612, created_at 2026_01_01;)

Elastic Detection

sequence by process.executable with maxspan=5m
  [process where process.name == "SpringBoard" or process.name == "launchd"]
  [network where destination.port in (80, 443) and process.name in ("SpringBoard", "launchd")]

Splunk SPL Query

index=macos OR index=endpoint sourcetype=osx_unified_log
| search ("identifierForVendor" OR "deviceIdentifier" OR "persistentDeviceIdentifier")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, signature
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="apple,cve-2026-84612,">
  <rule id="100712" level="5">
    <if_sid>60000</if_sid>
    <field name="process">SpringBoard|launchd</field>
    <match>identifierForVendor|deviceIdentifier|persistentDeviceIdentifier</match>
    <description>CVE-2026-84612: Potential unauthorized access to persistent device identifiers by an application</description>
    <mitre>
      <id>T1555</id>
    </mitre>
    <group>privacy,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 2/4 (CLAIMED) — a single source (NVD) claims a patch exists, but it has not been independently confirmed by a vendor advisory or secondary source. Treat the patch status as unverified until Apple publishes a corresponding security advisory.

1) Immediate mitigations:

• Restrict application installation to trusted sources (Apple App Store, notarized and reviewed apps) and disable side-loading/marketplace installs where policy allows.
• Educate users about installing only vetted applications and about phishing that delivers malicious app profiles.
• On managed devices, use MDM to enforce allowlists and block unknown app sources.
• Where supported, apply privacy controls that limit third-party access to identifiers and review app entitlements.
• Treat any affected (unpatched) device as potentially leaking identifiers; avoid relying on device identifiers for security-critical decisions until patched.

2) Patch / upgrade steps:

• Upgrade to the fixed versions: iOS 26.7 / iPadOS 26.7 (or iOS 27 / iPadOS 27), macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
• Stage updates through MDM across all affected platform families; verify version compliance in asset inventory.
• Prioritize patching for privacy-sensitive and regulated user populations.

3) Long-term hardening:

• Maintain an accurate inventory of all Apple OS versions across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS to reduce mixed-version exposure.
• Adopt continuous vulnerability management aligned to vendor security advisory feeds.
• Monitor for future public advisory confirmation of this CVE and adjust patch confidence accordingly.
• Reassess reliance on persistent device identifiers in any homegrown or third-party analytics and security tooling.

References

1. NVD Entry for CVE-2026-84612 — https://nvd.nist.gov/vuln/detail/CVE-2026-84612
2. Apple Security Releases (vendor advisory portal) — https://support.apple.com/en-us/HT201222
3. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
4. CVSS 3.1 Specification — https://www.first.org/cvss/v3.1/specification-document
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of report date) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on threat actor activity: No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-84612 in the provided data. The CVE is not listed in CISA KEV, no public PoC or exploit code exists, and the EPSS score is low (0.00172). Any attribution to a specific campaign would be speculative and is deliberately omitted.