Apple Shortcuts CVE-2026-84600

Exploitation requires the victim to obtain and execute a malicious Apple Shortcut on an unpatched device (iOS/iPadOS/macOS/tvOS/visionOS/watchOS prior to version 27). The specific abused feature is the Shortcuts messaging action, which normally requires user confirmation before sending a message; the authorization flaw lets a crafted shortcut suppress that confirmation. Limiting factors: user interaction is required (the victim must add and run the shortcut, UI:R), the impact is confined to unauthorized message sending (integrity/privacy, no code execution or privilege escalation, A:N, S:U), and all affected platforms are patched in the '27' release train.

This is a genuine but low-to-moderate severity issue, not a high-priority emergency. All exploitation signals point to low real-world risk: EPSS is 0.16% (6th percentile), there is no CISA KEV listing, and no public exploit code has been identified. The vulnerability is an authorization flaw (CWE-285) in Apple's Shortcuts, allowing a malicious shortcut to send messages without the expected user-confirmation prompt - an integrity/privacy abuse rather than a code-execution or privilege-escalation bug (I:L/C:L, A:N, S:U). A notable conflict exists in the vendor CVSS vector: it is scored AV:N (network), but the described mechanism - a malicious Shortcut executing on the device - is fundamentally local automation abuse that requires the shortcut to be present and run on the victim device (UI:R). The AV:N rating appears overstated; AV:L better fits the mechanism (verify with vendor). There is no active exploitation and no weaponization evidence. Priority is routine patch-cycle, driven by the ubiquity of the affected Apple platforms rather than by exploit pressure.

An attacker crafts and distributes a malicious Shortcut (e.g., shared via a link, shortcut gallery, or social engineering) that a victim adds and runs. When executed, the shortcut abuses the authorization flaw to silently send iMessage/SMS messages without the normal user-confirmation dialog, enabling spam, smishing propagation, or exfiltration of small amounts of data to attacker-controlled recipients. No public exploit code is identified, and user interaction (running the shortcut) is required.