CVE-2026-20662

mediumpriority · track · 18EPSS 0.002 · 7 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.18% (7th) EPSS

CVSS 4.6 · medium

Is it mine?

12 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An attacker with physical access to a locked device may be able to view sensitive user information.

cvss

Technical severity, 0–10. One row per scoring source.

4.6

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.6mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 0.9 · impact 3.6

v3.14.6mediumAV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.14.6mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.14.6mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 0.9 · impact 3.6

v3.14.2mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.6mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-200US

affected products (12)

Products and version ranges known to be affected.

Apple macOS≤ Sonoma <14.8.4cert_bundDE
Apple macOS≤ Sequoia <15.7.4cert_bundDE
Apple macOS≤ Tahoe <26.3cert_bundDE
Apple macOS0 → 15.7.4enisa_euvdEU
Apple macOS0 → 26.3enisa_euvdEU
Apple Inc. MacOS≤ 15.7.4fstec_bduRU
Apple Inc. MacOS≤ 26.3fstec_bduRU
Apple macOS Sequoia≤ vers:unknown/*ncsc_nlNL
Apple macOS Sonoma≤ vers:unknown/*ncsc_nlNL
Apple macOS Tahoe≤ vers:unknown/*ncsc_nlNL
apple macos< 15.7.4nvdUScpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
apple macos26.0 → 26.3nvdUScpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0063Kwetsbaarheden verholpen in Apple macOSNL2026-02-13csaf · ncsc_nlNL
Apple heeft kwetsbaarheden verholpen in macOS, inclusief versies Sequoia 15.7.4, Tahoe 26.3 en Sonoma 14.8.4.
WID-SEC-W-2026-0403Apple macOS Tahoe, Sequoia und Sonoma: Mehrere SchwachstellenDeutsch2026-02-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl nvd NVD CVE.org MITRE

published 2026-02-11modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

https://support.apple.com/en-us/126348 cnnvd
https://support.apple.com/en-us/126349 cnnvd
https://support.apple.com/en-us/126348 enisa_euvd
https://support.apple.com/en-us/126349 enisa_euvd
https://support.apple.com/en-us/126348Release NotesVendor Advisorynvd
https://support.apple.com/en-us/126349Release NotesVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan