What is the CVSS score of CVE-2026-20626?

CVE-2026-20626 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20626?

CVE-2026-20626 is a HIGH severity vulnerability affecting Apple devices (macOS, iOS, iPadOS, and visionOS) with no patch currently available, creating immediate risk for organizations with…

How to fix or mitigate CVE-2026-20626?

Within 24 hours: Identify and inventory all affected Apple devices running macOS Sequoia pre-15.7.4, iOS pre-26.3, iPadOS pre-26.3, macOS Tahoe pre-26.3, or visionOS pre-26.3 and assess criticality. Within 7 days: Implement network segmentation to isolate critical Apple devices, disable unnecessary services if feasible, and establish a patching plan for when updates become available. Within 30 days: Apply all available security patches immediately upon release and verify patch deployment across the organization.

Apple CVE-2026-20626

HIGH

Missing Authorization (CWE-862)

2026-02-11 product-security@apple.com

Apple Authentication Bypass

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A malicious app may be able to gain root privileges.

AnalysisAI

Privilege escalation vulnerability in Apple's macOS, iOS, iPadOS, and visionOS allows a malicious application to obtain root-level access through insufficient authorization checks. Local attackers with the ability to install or execute an app can exploit this to gain complete system control. No patch is currently available for this high-severity vulnerability affecting multiple Apple platforms.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Ipados. This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, visionOS 26.3. A malicious app may be able to gain root privileges.