What is the CVSS score of CVE-2026-20617?

CVE-2026-20617 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Ipados are affected by CVE-2026-20617?

CVE-2026-20617 is a race condition affecting multiple Apple platforms (iOS, macOS, tvOS, iPadOS, visionOS, watchOS) that could allow attackers to exploit timing-dependent vulnerabilities in state…

How to fix or mitigate CVE-2026-20617?

Within 24 hours: Inventory all affected Apple devices and OS versions across the organization. Within 7 days: Develop a phased patch deployment plan prioritizing critical business systems and users with elevated access. Within 30 days: Complete patching of all vulnerable devices to the specified versions (iOS/iPadOS/watchOS/tvOS/visionOS 26.3 or macOS Sonoma 14.8.4 or later).

Ipados CVE-2026-20617

HIGH

Race Condition (CWE-362)

2026-02-11 product-security@apple.com

Apple Race Condition Information Disclosure Ipados Iphone Os Tvos Visionos Watchos

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.0

DescriptionNVD

A race condition was addressed with improved state handling. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to gain root privileges.

AnalysisAI

Unprivileged local users can exploit a race condition in Apple's operating systems (macOS, iOS, iPadOS, tvOS, and visionOS) to escalate privileges to root through improper state handling during concurrent operations. This vulnerability affects multiple OS versions and requires local access with low privileges to trigger, making it exploitable by malicious applications or local attackers. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-362 (Race Condition). Affects Ipados. A race condition was addressed with improved state handling. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to gain root privileges.