EUVD-2026-15068Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Impact | While the CVSS score and vector are not available, the vulnerability is classified as Information Disclosure with broad platform impact across iOS, iPadOS, and multiple macOS versions, suggesting moderate to significant real-world risk. The fact that Apple released patches across six different security bulletins (126346, 126348, 126349, 126350, 126794, 126795, 126796) indicates the vendor prioritized this issue across multiple OS families simultaneously, implying elevated concern. The attack vector likely requires local code execution within an application context, which raises the complexity bar but is still achievable through malicious or compromised apps in the App Store ecosystem. Without CVSS vector details, EPSS scoring, or KEV confirmation, the exploitation probability cannot be precisely quantified, but the rapid multi-platform patching response and the nature of symlink vulnerabilities (which are well-understood attack vectors) suggest this represents a genuine security priority rather than a theoretical issue. Organizations should treat this as a medium-to-high priority for patching timelines given the sensitivity of user data at risk and the potential for sandboxed application escape. |
| Exploit ScenarioDerived | A malicious application distributed through the App Store could exploit the symlink handling vulnerability to break out of its sandbox restrictions and access sensitive user data such as private messages, photos, or authentication tokens stored in protected directories. By crafting symbolic links within the application's permitted file system access zone that point to restricted user directories, the application could leverage the OS's improper symlink resolution to read data it should not have access to. This could occur without explicit user awareness or additional interaction beyond installation and basic use of the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
This vulnerability involves improper handling of symbolic links in Apple operating systems that could allow an application to access user-sensitive data without proper authorization. The flaw affects iOS and iPadOS versions prior to 26.3, macOS Sequoia versions prior to 15.7.4, macOS Sonoma versions prior to 14.8.4, and macOS Tahoe versions prior to 26.3 and 26.4. An attacker with the ability to execute code in a sandboxed application context could potentially bypass security restrictions to access protected user information, though no active exploitation in the wild has been confirmed at this time.
RemediationAI
Immediately update iOS devices to version 26.3 or later, update iPadOS to version 26.3 or later, update macOS Sequoia to version 15.7.4 or later, update macOS Sonoma to version 14.8.4 or later, and update macOS Tahoe to version 26.3 or later. Consult the corresponding Apple security advisories at the vendor URLs provided (https://support.apple.com/en-us/126346 through 126796) for detailed patch availability and installation procedures. Until patching is completed, administrators should enforce stricter application sandboxing policies, disable unnecessary file system permissions for applications, and monitor system logs for suspicious symlink access patterns. Additionally, review installed third-party applications for legitimacy and consider restricting app installations to verified sources pending patch deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a symlink handling issue classified as an Information Disclosure vulnerability (CWE category not specified in available data). The affected technology involves the file system abstraction layer across Apple's operating systems that processes symbolic links. CPE data indicates the vulnerability impacts the broader Apple iOS/iPadOS platform (cpe:2.3:a:apple:ios_and_ipados) and Apple macOS platform (cpe:2.3:a:apple:macos) across multiple releases. The root cause relates to insufficient validation or sanitization of symbolic link references, which could allow applications to traverse security boundaries and access sensitive files outside their intended sandbox environment. This is a class of vulnerability where attackers exploit the operating system's symlink resolution mechanism to circumvent access controls that should prevent applications from reading user-sensitive data.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
Executive ViewAI
Organizations using This should be aware of moderate risk from CVE-2026-20694 rated CVSS 5.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
GitHub PoC
Exploit-DB