CVE-2026-20622
Apple Macos 15.0 – 15.7.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-20622 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20622 is a privacy vulnerability stemming from improper handling of temporary files, classified under CWE-284 (Improper Access Control). It affects macOS Sequoia versions prior to 15.7.4 and macOS Tahoe versions prior to 26.3. The flaw enables an app to capture a user's screen, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Any app, potentially delivered remotely given the network vector, can exploit this issue to access and capture the user's screen content without authentication or interaction. Attackers achieve high-impact confidentiality breaches by reading sensitive screen data, such as displayed credentials, documents, or other private information, while leaving integrity and availability unaffected.
Apple's security advisories detail the fix through improved temporary file handling, available in macOS Sequoia 15.7.4 and macOS Tahoe 26.3. Practitioners should prioritize updating affected systems, as outlined in the referenced support pages: https://support.apple.com/en-us/126348 and https://support.apple.com/en-us/126349.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15037
Vulnerability Data
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to capture a user's screen.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
Enforces flow-control policies that restrict information movement between subjects and objects.
Documents duties and assigns access so that no single account can bypass intended restrictions.
Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.
Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.
A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.
A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)
A.6.7's policy, rules, mechanisms, authentication requirements, remote access controls, network restrictions, and device measures (e.g. screen locks, firewalls, malware protection) directly stop unauthorized actors from exploiting improper access control in remote settings; remainder is non-remote or physical-only slices of CWE-284 (as in AC-3's own mostly precedent).
A.8.1 mandates access controls, storage encryption, software restrictions, malware protection, remote lock/wipe, physical/logical device protections, and policy-driven enforcement that stop unauthorized actors from exploiting improper access control on endpoints; remainder is non-endpoint or non-device slices of CWE-284 (e.g. server-side authorization logic).
A.8.2 directly controls allocation, review, expiry, temporary use, separate identities and heightened authentication for privileged rights per the access policy, which stops most improper-access-control exploitation paths for privileged resources; the bounded remainder is non-privileged improper access control (e.g. ordinary user rights, path traversal, CSRF).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.