What is the CVSS score of CVE-2026-20694?

CVE-2026-20694 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20694?

Organizations using This should be aware of moderate risk from CVE-2026-20694 rated CVSS 5.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-20694?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-20694

EUVD-2026-15068 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-03-25 apple

Apple Information Disclosure macOS iOS

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4,15.7.5,14.8.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15068

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.5

DescriptionCVE.org

This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.

AnalysisAI

This vulnerability involves improper handling of symbolic links in Apple operating systems that could allow an application to access user-sensitive data without proper authorization. The flaw affects iOS and iPadOS versions prior to 26.3, macOS Sequoia versions prior to 15.7.4, macOS Sonoma versions prior to 14.8.4, and macOS Tahoe versions prior to 26.3 and 26.4. An attacker with the ability to execute code in a sandboxed application context could potentially bypass security restrictions to access protected user information, though no active exploitation in the wild has been confirmed at this time.

Technical ContextAI

The vulnerability is a symlink handling issue classified as an Information Disclosure vulnerability (CWE category not specified in available data). The affected technology involves the file system abstraction layer across Apple's operating systems that processes symbolic links. CPE data indicates the vulnerability impacts the broader Apple iOS/iPadOS platform (cpe:2.3:a:apple:ios_and_ipados) and Apple macOS platform (cpe:2.3:a:apple:macos) across multiple releases. The root cause relates to insufficient validation or sanitization of symbolic link references, which could allow applications to traverse security boundaries and access sensitive files outside their intended sandbox environment. This is a class of vulnerability where attackers exploit the operating system's symlink resolution mechanism to circumvent access controls that should prevent applications from reading user-sensitive data.

RemediationAI

Immediately update iOS devices to version 26.3 or later, update iPadOS to version 26.3 or later, update macOS Sequoia to version 15.7.4 or later, update macOS Sonoma to version 14.8.4 or later, and update macOS Tahoe to version 26.3 or later. Consult the corresponding Apple security advisories at the vendor URLs provided (https://support.apple.com/en-us/126346 through 126796) for detailed patch availability and installation procedures. Until patching is completed, administrators should enforce stricter application sandboxing policies, disable unnecessary file system permissions for applications, and monitor system logs for suspicious symlink access patterns. Additionally, review installed third-party applications for legitimacy and consider restricting app installations to verified sources pending patch deployment.