EUVD-2026-15037Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit temporary file handling vulnerability
-
ExploitAccess screen capture capability
-
ImpactExfiltrate sensitive user screen content without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must develop and distribute a malicious app that the victim installs on macOS Sequoia (before 15.7.4) or macOS Tahoe (before 26.3). The app exploits improper temporary file handling to capture screen content without user consent or awareness. |
| Impact | While CVSS and EPSS scores are not available for this CVE, the risk profile is substantive based on multiple factors. The vulnerability requires no user interaction beyond running an application, and the attack vector is local (application on the same system), suggesting moderate attack complexity. The technical impact is high—information disclosure of sensitive screen content constitutes a direct privacy breach. The fact that Apple issued fixes across two macOS versions (Sequoia 15.7.4 and Tahoe 26.3) indicates this was treated as a priority security matter. Without KEV or POC information in the intelligence, this appears to be a proactively patched vulnerability rather than one under active exploitation, but the privacy implications remain significant for unpatched systems. |
| Exploit ScenarioDerived | An attacker distributes a seemingly benign productivity application through third-party app stores or direct distribution. Once installed and granted basic permissions, the application leverages the temporary file handling vulnerability to access screen capture data, enabling it to exfiltrate sensitive information such as banking credentials, confidential documents, or private communications visible on the user's screen. The attack requires only that the user runs the compromised application—no additional interaction or elevated privileges are necessary, making this a practical threat in real-world scenarios where users install software from untrusted sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A privacy vulnerability in macOS allows applications to capture a user's screen through improper handling of temporary files. The issue affects macOS Sequoia versions prior to 15.7.4 and macOS Tahoe versions prior to 26.3, enabling unauthorized screen capture by malicious or compromised applications. This vulnerability represents an information disclosure threat where sensitive user data visible on screen could be exfiltrated without user consent or awareness.
RemediationAI
Users should immediately update to macOS Sequoia 15.7.4 or macOS Tahoe 26.3 or later, as Apple has patched the underlying temporary file handling vulnerability in these releases. The patches are available through System Preferences > Software Update. Until systems can be updated, users should review and restrict application permissions in System Preferences > Security & Privacy, disable screen sharing and remote access features if not actively needed, and monitor installed applications for suspicious behavior. Additional mitigations include using privacy screen overlays for sensitive work and reviewing application permissions regularly. For detailed patch information and validation, consult Apple's security advisories at https://support.apple.com/en-us/126348 and https://support.apple.com/en-us/126349.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from inadequate security controls around temporary file handling in macOS, which relates to CWE-based information disclosure through insecure temporary file management. The affected products are identified via CPE as Apple macOS across multiple versions (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the flaw exists in the core operating system's file system abstraction and screen capture mechanisms. The root cause involves temporary files used by the screen capture process or related APIs not being properly isolated or protected, allowing unprivileged applications to access or monitor these files to extract screen contents.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (apple) · only source for this CVE.
CVSS VectorVendor: apple
Lifecycle Timeline
3DescriptionCVE.org
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to capture a user's screen.
Executive ViewAI
CVE-2026-20622 is a privacy vulnerability in macOS that allows applications to capture user screens through temporary file mishandling, potentially exposing sensitive data without user awareness. Organizations with macOS Sequoia or Tahoe deployments face risk of unauthorized information disclosure if users run malicious or compromised applications. This vulnerability directly impacts confidentiality of data visible on affected systems and requires prompt patching to prevent data exfiltration.
Apply vendor patch. Sequoia users must update to 15.7.4+; Tahoe users must update to 26.3+. Until patched, restrict installation of unverified third-party applications and use application allowlisting policies where technically feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB