CVE-2026-84584 is a high severity (CVSS 8.4) link following flaw in macOS Archive Utility. An app may be able to break out of its sandbox. The record and Apple list the fix only in macOS Golden Gate 27, handled with improved symlink handling.
What's affected
The record covers macOS and lists a single fixed release, macOS Golden Gate 27. Apple's page for Golden Gate 27 lists this CVE under Archive Utility, with the impact that an app may be able to break out of its sandbox, and says the issue was addressed with improved handling of symlinks.
Unlike the other Apple CVEs in this batch, this one is not listed for Sequoia 15.8 or Tahoe 26.7. I read Apple's Tahoe 26.7 page, and it does not mention this CVE under Archive Utility. So Macs on Sequoia or Tahoe have no listed fix for this entry. Check Apple's security notes for later updates.
The CVSS vector is local, low complexity and low privileges, with no interaction and a changed scope.
Apple's page for macOS Golden Gate 27, dated 14 September 2026, lists this CVE under Archive Utility. The record names only that release as the fix. I did not find the CVE on Apple's Tahoe 26.7 page, and I did not check the Sequoia page, so I cannot confirm a fix for those lines.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update Macs that can run macOS Golden Gate 27 to that release, after testing your key apps.
- For Macs staying on Sequoia or Tahoe, install the latest update and watch Apple's security notes for a fix for this entry.
- Use device management to track which Macs run which major version, so you can see who has no listed fix.
- Install apps only from the App Store or from developers you trust.
- Reduce the use of archive extraction on files from untrusted senders until a fix is in place.
Why it matters
Link following, tracked as CWE-59, is a trap with symbolic links. A symlink is a file that points to another file. If a program acts on a path without checking whether it resolves somewhere else, an attacker can arrange for the program to work on a different file than the one it expects. Archive tools are exposed to this because archives can contain links.
Here the effect is a sandbox escape. A sandboxed app that can use Archive Utility's behaviour to reach files outside its own area has stepped over a security boundary. The attacker needs code running in an app first. The record does not list this CVE as exploited in the wild.
Quick check
Why is only Golden Gate 27 listed?
The record and Apple's Golden Gate 27 page list that release. Apple's Tahoe 26.7 page does not mention this CVE.
What should Sequoia and Tahoe users do?
Install the latest updates, and watch Apple's security notes for a later fix that covers this entry.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
