CVE-2026-20622
Published: 25 March 2026
Summary
CVE-2026-20622 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Screen Capture (T1113); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-20622 is a privacy vulnerability stemming from improper handling of temporary files, classified under CWE-284 (Improper Access Control). It affects macOS Sequoia versions prior to 15.7.4 and macOS Tahoe versions prior to 26.3. The flaw enables an app to capture a user's screen, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Any app, potentially delivered remotely given the network vector, can exploit this issue to access and capture the user's screen content without authentication or interaction. Attackers achieve high-impact confidentiality breaches by reading sensitive screen data, such as displayed credentials, documents, or other private information, while leaving integrity and availability unaffected.
Apple's security advisories detail the fix through improved temporary file handling, available in macOS Sequoia 15.7.4 and macOS Tahoe 26.3. Practitioners should prioritize updating affected systems, as outlined in the referenced support pages: https://support.apple.com/en-us/126348 and https://support.apple.com/en-us/126349.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15037
Vulnerability details
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to capture a user's screen.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables unauthorized screen capture by any app due to improper temporary file access control, matching T1113 Screen Capture for confidentiality impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and correction of flaws like improper temporary file handling, directly mitigating the vulnerability enabling unauthorized screen capture.
Enforces approved authorizations for access to system resources such as temporary files, preventing apps from reading screen content without permission.
Limits privileges of executing apps to the minimum necessary, blocking unauthorized access to screen data via temporary files.