CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.

• CWE-22

• https://support.apple.com/en-us/149034Vendor Advisory, Release Notes
• https://support.apple.com/en-us/149041Vendor Advisory, Release Notes

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84587A permissions issue was addressed with additional restrictio…5.5
• CVE-2026-84588A memory corruption issue was addressed by removing the vuln…6.5
• CVE-2026-84589A permissions issue was addressed with additional restrictio…5.5
• CVE-2026-84593A use after free issue was addressed with improved memory ma…5.5
• CVE-2026-84596An out-of-bounds read was addressed with improved bounds che…6.5
• CVE-2026-84597An out-of-bounds read issue was addressed with improved inpu…6.5
• CVE-2026-84600An authorization issue was addressed with improved state man…5.4
• CVE-2026-84601A permissions issue was addressed with improved state manage…5.5
• CVE-2026-84602A type confusion issue was addressed with improved checks. T…5.5
• CVE-2026-84603A permissions issue was addressed with additional restrictio…5.5
• CVE-2026-84606A privacy issue was addressed with improved handling of iden…7.5
• CVE-2026-84607A race condition was addressed with improved state managemen…7.8