Apple iOS and iPadOS CVE-2026-84598

Exploitation requires PHYSICAL access to the target iPhone/iPad AND an existing trust pairing with that device (a previously accepted 'Trust This Computer'/accessory relationship). The path traversal is triggered over that trusted connection to read and write files outside the sanctioned path. Limiting factors: the attacker must physically possess the device, the device must already be trust-paired (no cold/first-contact exploitation), and the target must run iOS/iPadOS earlier than 26.7 or 27. There is no remote or unauthenticated network path despite the vendor's AV:N metric.

The published CVSS vector (AV:N/AC:L/PR:N/UI:N, base 7.5) directly CONFLICTS with the description, which explicitly states the attacker needs 'physical access to a trust-paired device.' This is an attack vector of PHYSICAL (AV:P), not NETWORK - the 7.5 base score is therefore inflated and should be treated with skepticism; verify with vendor (Apple advisories 149034/149041). The vector also lists I:N (no integrity impact), but the description says the attacker can 'read and write arbitrary files,' so integrity impact should be HIGH - the vendor scoring is internally inconsistent on two metrics. Real-world risk is LOW-to-MODERATE despite the 7.5 label: EPSS is only 0.15% (5th percentile), there is no CISA KEV listing, and no public exploit was identified. The physical-access-plus-existing-trust-pairing precondition sharply limits practical exploitation to targeted scenarios (e.g., an unlocked/previously-paired device in an adversary's hands), not remote or scalable attacks. This is a genuine local file-access flaw worth patching but is not an urgent internet-facing priority.

An attacker with hands-on possession of an iPhone or iPad that has previously established a trust pairing (e.g., via a paired computer or accessory) connects to the device and abuses insufficient path validation to traverse outside the intended directory, reading and writing arbitrary files. No public exploit code was identified, and success requires both physical control of the device and an existing trust relationship.