What is the CVSS score of CVE-2026-20667?

CVE-2026-20667 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-20667?

CVE-2026-20667 is a high-severity logic flaw affecting Apple's ecosystem (iOS, iPadOS, macOS, watchOS) with no patch currently available.

How to fix or mitigate CVE-2026-20667?

Within 24 hours: Identify and inventory all affected Apple devices (iOS 26.2 and below, macOS versions below 14.8.4/15.7.4, watchOS below 26.3). Within 7 days: Implement network segmentation for affected devices, disable non-essential features if available, and enable Enhanced Security monitoring. Within 30 days: Deploy patches immediately upon Apple's release and verify successful remediation across all affected systems.

Apple CVE-2026-20667

HIGH

Protection Mechanism Failure (CWE-693)

2026-02-11 product-security@apple.com

Apple Information Disclosure

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

A logic issue was addressed with improved checks. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3. An app may be able to break out of its sandbox.

AnalysisAI

Sandbox escape in Apple macOS, iOS, and watchOS allows local authenticated attackers to break out of application sandboxes and gain unauthorized access to system resources and other applications' data. The vulnerability stems from insufficient validation logic in sandbox enforcement mechanisms, enabling privilege escalation with high impact on confidentiality, integrity, and availability across affected devices. No patch is currently available.

Technical ContextAI

Classified as CWE-693 (Protection Mechanism Failure). Affects Ipados. A logic issue was addressed with improved checks. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3. An app may be able to break out of its sandbox.