CVE-2026-84600

Shortcuts

Impact: A malicious shortcut may be able to send messages without user confirmation.

Description: An authorization issue was addressed with improved state management.

Products: iOS and iPadOS, macOS, tvOS, visionOS, watchOS

Fixed In:

• iOS 27 and iPadOS 27
• macOS Golden Gate 27
• tvOS 27
• visionOS 27
• watchOS 27

Research Context: Reported against pre-release software.

Credit: Owen Pawling (@owenpawling)

Security Releases

• https://support.apple.com/en-us/149034
• https://support.apple.com/en-us/149035
• https://support.apple.com/en-us/149036
• https://support.apple.com/en-us/149037
• https://support.apple.com/en-us/149038

Weakness Classification

CWE-285: Improper Authorization

CVSS v3.1

Source: CISA ADP
Base Score: 5.4 (MEDIUM)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Metric	Value
Attack Vector (AV)	Network
Attack Complexity (AC)	Low
Privileges Required (PR)	None
User Interaction (UI)	Required
Scope (S)	Unchanged
Confidentiality (C)	Low
Integrity (I)	Low
Availability (A)	None

CISA SSVC

Decision Point	Value
Exploitation	None
Automatable	No
Technical Impact	Partial

CVE Metadata

CVE ID: CVE-2026-84600
Reported to Apple: June 14, 2026
CNA: Apple
Status: Published
Reserved: September 1, 2026
Published: September 14, 2026
Last Updated: September 17, 2026