What is the CVSS score of CVE-2026-20650?

CVE-2026-20650 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by CVE-2026-20650?

CVE-2026-20650 is a high-severity denial-of-service vulnerability affecting Apple's ecosystem (iOS, iPadOS, macOS, watchOS, tvOS, and visionOS).

How to fix or mitigate CVE-2026-20650?

Within 24 hours: Inventory all affected Apple devices across your organization and document business-critical systems relying on these platforms. Within 7 days: Implement network segmentation and access controls to limit potential DoS impact; disable non-essential services on vulnerable devices where operationally feasible. Within 30 days: Establish a vendor communication protocol with Apple to track patch release timelines; prepare patch deployment procedures and test in non-production environments upon patch availability.

Apple CVE-2026-20650

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-02-11 product-security@apple.com

Apple Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.5

DescriptionCVE.org

A denial-of-service issue was addressed with improved validation. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Bluetooth packets.

AnalysisAI

Denial-of-service attacks targeting Apple's Bluetooth stack (macOS, iOS, visionOS, watchOS) can be triggered by attackers with network access through specially crafted packets, causing service interruption without requiring user interaction. An attacker positioned on the same network segment can exploit insufficient input validation to crash Bluetooth functionality across affected devices. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Ipados. A denial-of-service issue was addressed with improved validation. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Bluetooth packets.