What is the CVSS score of CVE-2026-20615?

CVE-2026-20615 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20615?

A path handling vulnerability affecting Apple's iOS, iPadOS, macOS, and visionOS platforms poses a HIGH risk to organizations with Apple device deployments.

How to fix or mitigate CVE-2026-20615?

Within 24 hours: Inventory all affected Apple devices (iOS, iPadOS, macOS Tahoe, macOS Sonoma, visionOS) and restrict their use on critical networks until patching guidance is available. Within 7 days: Implement network segmentation to isolate affected devices and enable enhanced monitoring for suspicious file system access patterns. Within 30 days: Establish a patch management plan to deploy fixes immediately upon vendor release and conduct post-incident review of device access logs.

Apple CVE-2026-20615

HIGH

Path Traversal (CWE-22)

2026-02-11 product-security@apple.com

Apple Path Traversal

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3. An app may be able to gain root privileges.

AnalysisAI

Local privilege escalation in Apple macOS, iOS, and iPadOS through improper path validation allows authenticated attackers to gain root privileges on affected devices. The vulnerability requires local access and user interaction is not required, making it exploitable by malicious applications already present on the system. No patch is currently available for this high-severity flaw affecting multiple Apple operating systems.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Ipados. A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3. An app may be able to gain root privileges.