Loading vulnerability…
Unauthorized Sensitive Data Access in Apple Shortcuts
CVE-2026-112559 is an authorization vulnerability in the Shortcuts component of Apple iOS, iPadOS, macOS, visionOS, and watchOS. Improper authorization state management may allow an application to access sensitive user data without the required authorization. Apple addressed the issue through improved state management. The specific vulnerable functions and triggering conditions have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An application may gain unauthorized access to sensitive user data, compromising user confidentiality. The specific data categories and scope of accessible information have not been disclosed.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround has been documented. Apply the applicable Apple security update.
Patch, then assume compromise.
Install the applicable fixed release: iOS 26.7.2 or 27.2; iPadOS 26.7.2 or 27.2; macOS Golden Gate 27.2, macOS Sequoia 15.8.2, or macOS Tahoe 26.7.2; visionOS 27.2; or watchOS 27.2. These updates correct the authorization issue through improved state management.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.