CVE-2026-84580 is a high severity (CVSS 8.4) missing authorization flaw in the macOS quarantine component. An app may be able to break out of its sandbox. Apple fixed it with improved checks in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS. Apple lists the fix under the quarantine component and describes the impact as follows: an app may be able to break out of its sandbox. Apple says the issue was addressed with improved checks. The record classes it as missing authorization.
The CVSS vector is local, low complexity and low privileges, with no user interaction and a changed scope. High impact on confidentiality and integrity is rated, with none on availability. The changed scope is the important part, because it means the effect reaches past the sandboxed app itself.
The record says the fix shipped in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, both dated 14 September 2026, and they list this CVE. I did not fetch the page for Sequoia 15.8, so I rely on the record for that one.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update each Mac to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7, whichever your hardware and policy support.
- Use your device management tool to push the update and report which Macs have not applied it.
- Set a deadline for Macs that are overdue, and follow up with their owners.
- Keep automatic security updates switched on for personal and unmanaged Macs.
- Install apps only from the App Store or from developers you trust, since a local flaw needs an app to be running.
Why it matters
Missing authorization, tracked as CWE-862, is a check that should have happened and did not. The sandbox limits what an app can touch. The quarantine component, the part of macOS that tracks downloaded files, was missing a check, so an app inside the sandbox could do something it should have been refused.
A sandbox escape matters because the sandbox is a layer of defence. Apps from the App Store, and many others, depend on it to keep a flaw in the app from becoming a flaw in the user's account. An attacker still needs code running inside the sandboxed app first, so this is a second step. The record does not list this CVE as exploited in the wild.
Quick check
Does an attacker need code running on the Mac first?
Yes. The vector is local with low privileges, so an app has to be running. The flaw lets it leave its sandbox.
Why is scope marked as changed?
Because the impact reaches resources outside the sandboxed app, which is what escaping the sandbox means.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
