CVE-2026-86891: 
macOS vulnerability analysis and mitigation

CVE-2026-86891 is an authorization bypass vulnerability in Apple's Core Bluetooth framework affecting macOS and watchOS. Due to insufficient state management, an app may be able to access Bluetooth device information without proper authorization. The vulnerability was disclosed on September 14, 2026, and affects macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, macOS Golden Gate prior to 27, and watchOS prior to 27. It is estimated as Medium severity by Feedly, with an EPSS score of 0.0 (Apple Advisory macOS Golden Gate, Apple Advisory watchOS 27, Apple Advisory macOS Tahoe, Apple Advisory macOS Sequoia).

The root cause is an authorization issue (CWE-285: Improper Authorization) in the Core Bluetooth component, stemming from insufficient state management controls that fail to properly enforce access restrictions on Bluetooth device information. An app running on an affected macOS or watchOS device can exploit this flaw to query Bluetooth device data — such as paired or nearby device identifiers — without holding the required entitlements or user-granted permissions. No special privileges or user interaction appear to be required beyond the ability to run an app on the affected system. The vulnerability was discovered and reported by Dawuge of Shuffle Team (Apple Advisory macOS Golden Gate, Apple Advisory watchOS 27).

Successful exploitation allows a malicious or compromised app to access information about Bluetooth devices paired with or detected by the affected macOS or watchOS system, representing a confidentiality impact. This could expose device identifiers, names, and presence information for Bluetooth peripherals, potentially enabling user tracking or device fingerprinting across sessions. Integrity and availability are not directly affected; the primary risk is unauthorized disclosure of Bluetooth device metadata (Apple Advisory macOS Golden Gate, Feedly Intelligence).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported (Feedly Intelligence).

Apple has released patches addressing this vulnerability in the following updates, all released September 14, 2026: macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and watchOS 27. Users and administrators should update affected devices to these versions or later as soon as possible. No configuration-based workaround has been published by Apple; updating to a patched release is the only recommended remediation (Apple Advisory macOS Golden Gate, Apple Advisory macOS Sequoia, Apple Advisory macOS Tahoe, Apple Advisory watchOS 27).