PatchTheCVECVE-2026-84586: An information disclosure issue was addressed with improved state management
CVE-2026-84586 is a medium-severity flaw (CVSS 5.5) affecting macos, watchos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 95%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2026-09-14 |
| Last modified | 2026-09-17 |
Last updated 2026-09-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-84586?
macos: upgrade to 27.0; watchos: upgrade to 27.0. Exact commands for each OS are on this page.
Is CVE-2026-84586 being exploited?
CVE-2026-84586 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-84586 affect?
CVE-2026-84586 affects macos, watchos. Severity is medium (CVSS 5.5). An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information.
How urgent is CVE-2026-84586?
Priority 20/100. No elevated risk signals yet.
Software pages
macOS vulnerabilities · watchOS vulnerabilities
Related CVEs
- CVE-2026-112529 HIGH n/a UPGRADE An out-of-bounds read was addressed with improved bounds checking
- CVE-2026-112483 HIGH n/a UPGRADE A path handling issue was addressed with improved validation
- CVE-2026-112495 HIGH n/a UPGRADE An out-of-bounds read was addressed with improved bounds checking
- CVE-2026-112456 HIGH n/a UPGRADE UPGRADE An out-of-bounds write issue was addressed with improved input validation
- CVE-2026-112513 HIGH n/a UPGRADE This issue was addressed with improved validation of symlinks