What is the CVSS score of CVE-2026-20686?

CVE-2026-20686 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-20686?

Organizations using This should be aware of moderate risk from CVE-2026-20686, a input validation vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-20686?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-20686

EUVD-2026-15057 MEDIUM

Improper Input Validation (CWE-20)

2026-03-25 apple

GHSA-qqh3-3q88-f879

Apple Information Disclosure iOS

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.3

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15057

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

This issue was addressed with improved input validation. This issue is fixed in iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.

AnalysisAI

An input validation flaw in iOS and iPadOS allows malicious applications to bypass security controls and access sensitive user data without proper authorization. The vulnerability affects iOS and iPadOS versions prior to 26.3, where insufficient input validation in an unspecified component permits unauthorized data disclosure. Apple has patched this vulnerability in iOS 26.3 and iPadOS 26.3, and there are no public indicators of active exploitation or proof-of-concept availability.

Technical ContextAI

This vulnerability stems from inadequate input validation in Apple's iOS and iPadOS operating systems, classified as an Information Disclosure issue. The root cause appears to be insufficient sanitization or validation of user-supplied input that fails to properly enforce access controls on sensitive data structures or APIs. While no specific CWE is formally assigned in the available data, the pattern of improved input validation as the remediation suggests this falls within the CWE-20 family (Improper Input Validation) or related categories such as CWE-284 (Improper Access Control). The affected products are identified via CPE string cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*, indicating all versions of iOS and iPadOS prior to the patched release are in scope, though the exact vulnerable version range is not explicitly specified in available intelligence.

RemediationAI

Users should upgrade to iOS 26.3 or iPadOS 26.3 or later immediately. Apple users can initiate the update through Settings > General > Software Update on their device. Until patching is possible, restrict the installation of applications from untrusted sources, review app permissions in Settings > Privacy, and disable installation of apps from developers without established trust. Organizations managing iOS/iPadOS fleets should deploy Mobile Device Management (MDM) solutions to enforce minimum OS version requirements and automate patch deployment. For detailed remediation steps and to access the full security advisory, visit Apple's support page at https://support.apple.com/en-us/126346.