What is the CVSS score of CVE-2026-20614?

CVE-2026-20614 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20614?

CVE-2026-20614 is a path handling vulnerability affecting macOS systems (Sequoia, Tahoe, and Sonoma) with high severity (CVSS 7.8) but currently no available patch.

How to fix or mitigate CVE-2026-20614?

Within 24 hours: Inventory all macOS Sequoia, Tahoe, and Sonoma systems across the organization and assess exposure. Within 7 days: Implement network segmentation to isolate affected systems where possible and disable non-essential file handling features if operationally feasible. Within 30 days: Monitor Apple security releases daily, establish criteria for emergency patching, and prepare deployment procedures for when patches become available; escalate to Apple support if your organization requires an expedited fix.

Apple CVE-2026-20614

HIGH

Path Traversal (CWE-22)

2026-02-11 product-security@apple.com

Apple Path Traversal

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3, macOS Sonoma 14.8.4. An app may be able to gain root privileges.

AnalysisAI

Improper path validation in macOS (Sequoia 15.7.3 and earlier, Tahoe 26.2 and earlier, Sonoma 14.8.3 and earlier) permits local authenticated users to escalate privileges to root through a malicious application. This path traversal vulnerability (CWE-22) has a CVSS score of 7.8 and currently lacks a publicly available patch.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Macos. A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3, macOS Sonoma 14.8.4. An app may be able to gain root privileges.