What is the CVSS score of CVE-2026-20607?

CVE-2026-20607 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20607?

Organizations using A permissions should be aware of moderate risk from CVE-2026-20607, a improper privilege management vulnerability rated CVSS 4.0.. A patch is available.

How to fix or mitigate CVE-2026-20607?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-20607

EUVD-2026-15035 MEDIUM

Improper Privilege Management (CWE-269)

2026-03-25 apple

GHSA-vcpf-hjm3-54fr

Apple Privilege Escalation macOS

4.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,26.4,14.8.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15035

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:31 nvd

MEDIUM 4.0

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access protected user data.

AnalysisAI

A permissions enforcement vulnerability in macOS allows applications to bypass security restrictions and access protected user data due to insufficient authorization checks. This issue affects macOS Sequoia (prior to 15.7.5), macOS Sonoma (prior to 14.8.5), and macOS Tahoe (prior to 26.4). An attacker with the ability to execute an application on the affected system could potentially access sensitive user information without proper user consent or authorization. No CVSS score, EPSS data, or active exploitation in the wild (KEV status) has been disclosed by Apple.

Technical ContextAI

This vulnerability stems from a permissions and access control issue within the macOS operating system, classified as an information disclosure weakness. The root cause involves insufficient enforcement of user data protection mechanisms, allowing applications to circumvent the permission boundaries that normally restrict access to sensitive user files and information. The affected product is the Apple macOS operating system across multiple major versions (Sequoia 15.x, Sonoma 14.x, and Tahoe 26.x), as indicated by CPE identifiers matching 'cpe:2.3:a:apple:macos'. Rather than a specific vulnerable library or protocol, this represents a system-level authorization control defect where the OS kernel or system frameworks fail to properly validate application entitlements before granting access to protected data categories such as contacts, photos, location, health data, or other privacy-sensitive information.

RemediationAI

Immediately apply the latest security updates provided by Apple: upgrade macOS Sequoia to version 15.7.5 or later, upgrade macOS Sonoma to version 14.8.5 or later, or upgrade macOS Tahoe to version 26.4 or later. Users should check System Preferences > General > Software Update to download and install the latest patches, which require a system restart. For organizations, deploy these updates through Mobile Device Management (MDM) or macOS security update tools to ensure rapid deployment across all systems. As a temporary mitigation prior to patching, restrict user permissions to install untrusted applications, disable third-party app installation, and enable Gatekeeper and XProtect settings to prevent execution of potentially malicious applications. Refer to the vendor advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for additional details and deployment guidance.