What is the CVSS score of CVE-2026-20701?

CVE-2026-20701 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-20701?

CVE-2026-20701 is a sandbox bypass vulnerability in macOS that allows locally installed applications to connect to network shares without user consent, potentially enabling data exfiltration or…. A patch is available.

How to fix or mitigate CVE-2026-20701?

Within 24 hours: Inventory all macOS devices running Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 and confirm patch availability in your environment. Within 7 days: Deploy macOS security updates to all affected systems-specifically macOS Sequoia 15.7.6 or later, macOS Sonoma 14.8.6 or later, and macOS Tahoe 26.5 or later. Within 30 days: Verify 100% deployment through mobile device management (MDM) or endpoint management tools and generate compliance report for audit trail.

macOS CVE-2026-20701

EUVD-2026-15075 HIGH

Protection Mechanism Failure (CWE-693)

2026-03-25 apple

GHSA-5g2j-7mcf-43r8

Apple Information Disclosure macOS

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:16 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,14.8.5,26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15075

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:35 nvd

HIGH 7.5

DescriptionCVE.org

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.

AnalysisAI

An access control vulnerability in macOS allows applications to connect to network shares without explicit user consent, bypassing the sandbox restrictions designed to prevent unauthorized network access. This affects macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4, where a malicious or compromised application could silently establish connections to network resources. Apple has addressed this issue through additional sandbox restrictions in the specified patch versions; no public exploit code or active exploitation via KEV has been reported, but the nature of the vulnerability suggests moderate real-world risk due to the ease with which local applications could abuse this capability.

Technical ContextAI

This vulnerability involves macOS sandbox enforcement mechanisms that govern inter-process communication and network access permissions. The sandbox is a core macOS security architecture that restricts application privileges to only those explicitly granted; this CVE indicates a gap in the entitlement and capability checking logic that gates network share connections (SMB/AFP protocols). Affected CPE includes all versions of Apple macOS across multiple releases (cpe:2.3:a:apple:macos), indicating the issue spans multiple OS versions and release branches. While no specific CWE is assigned, this falls within the class of improper access control vulnerabilities (CWE-284 and related categories) where authorization checks are insufficient or bypassable. The root cause appears to be insufficient validation of application permissions before allowing network share enumeration or connection establishment.

RemediationAI

Apply the latest security updates immediately: upgrade to macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later, depending on the currently deployed OS version. Detailed patching instructions are available in Apple's support documents at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796. As a temporary mitigation pending patching, restrict network share access to trusted hosts via firewall rules and disable SMB/AFP protocols where not actively required; additionally, audit running applications and revoke or restrict entitlements for third-party apps that do not require network access. Monitor system logs for suspicious network share connection attempts and implement application whitelisting policies to reduce exposure to untrusted code execution.