What is the CVSS score of CVE-2026-20660?

CVE-2026-20660 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Apple are affected by CVE-2026-20660?

CVE-2026-20660 is a path handling vulnerability affecting Apple's macOS, iOS, iPadOS, visionOS, and Safari with a HIGH severity rating (CVSS 7.5).

How to fix or mitigate CVE-2026-20660?

Within 24 hours: Inventory all Apple devices (macOS, iOS, iPadOS, visionOS) across the organization and identify which are running vulnerable versions. Disable Safari or restrict its use on critical systems if feasible. Within 7 days: Implement network-based monitoring and WAF rules to detect exploitation attempts; communicate vulnerability status and interim controls to device users. Within 30 days: Monitor Apple security advisories daily for patch availability and establish expedited testing/deployment procedures for when patches release; consider restricting high-risk user activities on affected devices until patched.

Apple CVE-2026-20660

HIGH

Path Traversal (CWE-22)

2026-02-11 product-security@apple.com

Apple Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.5

DescriptionCVE.org

A path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A remote user may be able to write arbitrary files.

AnalysisAI

Arbitrary file write vulnerability in Apple's macOS, iOS, iPadOS, and Safari resulting from improper path handling logic allows remote attackers to write files without authentication or user interaction. Affected versions include macOS Tahoe 26.3 and earlier, macOS Sonoma 14.8.4 and earlier, iOS 18.7.5 and earlier, and Safari 26.3 and earlier. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Safari. A path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A remote user may be able to write arbitrary files.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.