macOS CVE-2026-20701

Attacker must craft a malicious app that exploits sandbox bypass. User must install the app on vulnerable macOS versions (Sequoia before 15.7.5, Sonoma before 14.8.5, or Tahoe before 26.4). No explicit user interaction required after installation.

Without a published CVSS score or EPSS value, risk assessment relies on vulnerability characteristics and vendor response patterns. The attack vector is local (requiring code execution context on the macOS system), and attack complexity is low once an application is running with standard user privileges. The technical impact is information disclosure and potential unauthorized access to network shares containing sensitive data. The issue is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting limited active exploitation; however, the simplicity of the attack vector and the ubiquity of macOS systems make this a moderate priority. The fact that Apple addressed this through sandbox tightening rather than a critical patch indicates the vendor assessed it as important but not critical. Organizations using network shares for sensitive data should prioritize patching, especially in environments where untrusted applications may execute.

A user downloads a trojanized application from a third-party source that appears legitimate but contains malicious code. Once executed with user-level privileges, the trojan leverages this vulnerability to enumerate and connect to network shares (e.g., corporate file servers) available on the local network without triggering any user consent prompts or system notifications. The attacker can then exfiltrate sensitive files from accessible shares without user awareness or intervention, making this particularly dangerous in environments where network shares contain confidential business data or personal information.