CVE-2026-84600

Shortcut Framework Authorization Bypass Allowing Silent Message Transmission

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.

Analysis

AI-generated

Technical impact

The vulnerability is an authorization flaw in Apple’s shortcut framework that allows a malicious shortcut to trigger the message‑sending API without a user prompt, bypassing the normal confirmation step and enabling silent message or contact transmission. The weakness is classified as CWE-285.

Affected Systems

Apple operating systems that include the shortcut framework are affected: iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Versions prior to those releases that lack the state‑management fix are presumed vulnerable until updated.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. The EPSS score is reported as < 1 %, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is local; a malicious shortcut executed on the device—such as via a bundled application or a downloaded shortcut—can send messages without user approval.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest OS updates that include iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
  • Remove or disable any shortcuts that are configured to send messages without user confirmation, or revoke the shortcut permission that allows message transmission.
  • Educate users to review shortcut details and exercise caution before executing shortcuts that perform automatic actions.

Generated by OpenCVE AI on September 20, 2026 at 20:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Shortcut Framework Authorization Bypass Allowing Silent Message Transmission
Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Type Values Removed Values Added
Weaknesses CWE-285
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Shortcut Authorization Bypass Enabling Unsolicited Messaging
Weaknesses CWE-269
CWE-284
Type Values Removed Values Added
Title Shortcut Authorization Bypass Enabling Unsolicited Messaging
Weaknesses CWE-269
CWE-284
Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos
Vendors & Products Apple
Apple ios And Ipados
Apple macos
Apple tvos
Apple visionos
Apple watchos
Type Values Removed Values Added
Description An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation.
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:39 PM
Reserved
Sep 1, 2026, 9:13 PM

View source JSON

Updated
Sep 17, 2026, 2:33 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 18, 2026, 1:50 PM

View source JSON

No data.

Updated
Sep 20, 2026, 9:00 PM

JSON