What is the CVSS score of CVE-2026-20700?

CVE-2026-20700 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-20700?

Yes, a public proof-of-concept exploit is available for CVE-2026-20700. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-20700?

Within 24 hours: Inventory all Apple devices (mobile, desktop, wearables) in your environment and disable non-essential network access where feasible. Within 7 days: Implement enhanced endpoint monitoring for suspicious process behavior, memory access patterns, and lateral movement; escalate this to your SOC. Within 30 days: Establish a rapid patch deployment process with Apple when version 26.3 releases across all platforms, prioritizing devices with sensitive data access.

macOS CVE-2026-20700

HIGH

Buffer Overflow (CWE-119)

2026-02-11 product-security@apple.com

RCE Buffer Overflow Apple iOS macOS

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local system access
Exploit

Exploit memory corruption via state management
Execution

Write malicious data to memory
Impact

Execute arbitrary code with user privileges

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Local access required with user-level privileges (PR:L). Requires memory write capability on iOS, iPadOS, macOS Tahoe, tvOS, or visionOS versions prior to 26.3. No user interaction needed.
Impact	CVSS 7.8 (High). KEV-listed — confirmed sophisticated in-the-wild exploitation (likely spyware). Affects ALL Apple platforms. Kernel-level compromise bypasses all OS security. Public PoC available. Used as second stage in exploit chains.
Exploit ScenarioDerived	A targeted individual visits a compromised website or receives a malicious message that triggers a browser/messaging vulnerability (first stage) to gain initial code execution. The attacker then uses this kernel vulnerability (second stage) to escape the app sandbox and gain kernel-level access. With kernel control, the attacker installs persistent spyware that survives reboots, accesses all data on the device, activates microphone/camera, and exfiltrates communications — all invisible to the user.

Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.

Exploited in the wild (CISA KEV) No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CVE-2026-20700, CVSS 7.8) that allows attackers with memory write capability to execute arbitrary code at the kernel level. KEV-listed with Apple confirming reports of sophisticated in-the-wild exploitation, this represents an active zero-day targeting the Apple ecosystem at its most fundamental security boundary.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 7.8

Apple's kernel contains a memory corruption vulnerability (CWE-119) exploitable by attackers with memory write capability, enabling arbitrary kernel code execution across all Apple platforms. Apple acknowledges 'extremely sophisticated' in-the-wild exploitation.

RemediationAI

Update all Apple devices immediately. This is confirmed exploited by sophisticated actors. Push updates via MDM for enterprise devices. Verify update installation. High-risk individuals should check for spyware indicators using tools like iVerify or mobile threat defense solutions.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This kernel vulnerability requires the attacker to already have memory write capability (typically through a prior vulnerability in a userspace process or browser). The kernel bug then serves as the second stage in an exploit chain — escalating from userspace code execution to full kernel control. Apple's description of 'extremely sophisticated' exploitation suggests this is being used by advanced threat actors (likely commercial spyware vendors) in targeted attacks.

Know when macOS gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 25, 2026 - 17:39 cisa

CISA KEV

PoC Detected

Mar 25, 2026 - 17:39 vuln.today

Public exploit code

CVE Published

Feb 11, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 26.3, tvOS 26.3, macOS Tahoe 26.3, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.

Executive ViewAI

Why It Matters

A HIGH severity memory corruption vulnerability (CVE-2026-20700) is actively being exploited in the wild across Apple's entire ecosystem (iOS, iPadOS, macOS, tvOS, watchOS, visionOS). No patch is currently available, creating immediate risk to all Apple device users in your organization who could be targeted through remote exploitation.

Business Impact: High

Compensating Controls

Until patch availability: Enforce network segmentation to limit Apple device communication to essential services only; deploy behavioral analytics to detect exploitation attempts targeting memory corruption (unusual process spawning, privilege escalation); disable unnecessary features and services on affected devices; increase EDR/MDR monitoring sensitivity for Apple platforms; restrict user permissions to least privilege; consider temporary restrictions on untrusted app installations until patched.

Threat Intelligence Overview

Threat Score

4.6/10

Composite threat intelligence

EPSS Score

0.4%

Top 37% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

CISA KEV

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 0.4%

Patch available No

Active threat Yes

Deciding rule

Active threat signals + CRITICAL/HIGH severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

109

Low Medium High Critical

KEV: +50

EPSS: 0

CVSS: +39

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.