CVE-2026-20610
Published: 11 February 2026
Summary
CVE-2026-20610 is a high-severity Link Following (CWE-59) vulnerability in Apple Macos. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely identification, reporting, and correction of system flaws, directly mitigating CVE-2026-20610 by applying the macOS Tahoe 26.3 patch for improved symlink handling.
AC-6 enforces least privilege, limiting the scope and impact of privilege escalation from low-privileged apps exploiting symlink mishandling to gain root access.
AC-3 mandates enforcement of approved access authorizations, addressing improper symlink resolution that bypasses access controls to enable root privilege gain.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via symlink handling flaw matches Exploitation for Privilege Escalation.
NVD Description
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.
Deeper analysisAI
CVE-2026-20610 is a vulnerability stemming from improper handling of symlinks (CWE-59) in macOS Tahoe versions prior to 26.3. Published on 2026-02-11, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw enables an app to escalate privileges to root level.
Exploitation requires local access on the target system with low-privilege credentials, such as a standard user account. A local attacker can execute a malicious app that abuses the symlink resolution issue to gain root privileges, resulting in high-impact confidentiality, integrity, and availability violations.
Apple's advisory confirms the issue was fixed in macOS Tahoe 26.3 through improved symlink handling. Additional details are available at https://support.apple.com/en-us/126348.
Details
- CWE(s)