What is the CVSS score of CVE-2026-20697?

CVE-2026-20697 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20697?

Organizations using A permissions should be aware of moderate risk from CVE-2026-20697, a improper access control vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-20697?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

macOS CVE-2026-20697

EUVD-2026-15072 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-3mjv-8f83-6r45

Apple Authentication Bypass macOS

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.8.5,26.4,15.7.5

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15072

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.3

DescriptionCVE.org

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

A permissions enforcement vulnerability in macOS allows applications to bypass sandbox restrictions and access sensitive user data without proper authorization. The issue affects macOS Sequoia (versions before 15.7.5), macOS Sonoma (versions before 14.8.5), and macOS Tahoe (versions before 26.4). Apple has patched this vulnerability through enhanced permission restrictions, but no public exploit code or active in-the-wild exploitation has been confirmed at this time.

Technical ContextAI

This vulnerability represents a permissions validation failure within macOS's application sandbox and privacy controls framework. The affected products span multiple macOS versions as indicated by the CPE pattern cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, suggesting a systemic issue in how the operating system enforces access controls for sensitive user data. While the CWE classification is not provided, this type of vulnerability typically falls under CWE-284 (Improper Access Control) or CWE-276 (Incorrect Default Permissions). The vulnerability likely stems from insufficient validation of application permissions at a critical enforcement point within the kernel or system frameworks responsible for mediating access to protected user data such as photos, contacts, location, or calendar information.

RemediationAI

Immediately apply the latest security updates for your macOS version: upgrade to macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Navigate to System Settings > General > Software Update on the affected device and install all available updates. For organizations managing multiple macOS devices, prioritize deployment of these patches through mobile device management (MDM) solutions such as Apple Business Manager or third-party MDM platforms. Until patching is complete, review and restrict application permissions through System Settings > Privacy & Security, disabling unnecessary access to sensitive data (Photos, Contacts, Calendar, Location, etc.) for untrusted or non-essential applications. Additionally, consider limiting the installation of third-party applications to trusted sources and review app permissions regularly to enforce a least-privilege access model.