CVE-2026-20628
Published: 11 February 2026
Summary
CVE-2026-20628 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-20628 is a permissions issue, classified under CWE-284, that enables an app to break out of its sandbox on Apple operating systems. The vulnerability affects iOS and iPadOS prior to versions 18.7.5 and 26.3, macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, tvOS prior to 26.3, visionOS prior to 26.3, and watchOS prior to 26.3. It received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with low attack complexity but requiring local access and user interaction.
A local attacker with no privileges can exploit this vulnerability by tricking a user into interacting with a malicious app, such as opening or using it. Successful exploitation allows the app to escape its sandbox, potentially granting access to sensitive data or system resources outside its intended isolation, leading to unauthorized read/write operations on user files or other protected areas without affecting availability.
Apple's security advisories detail that the issue was addressed by adding additional restrictions to permissions handling. Mitigation requires updating to the fixed versions: iOS 18.7.5 or 26.3, iPadOS 18.7.5 or 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, or watchOS 26.3. Further details are available in the referenced support pages (https://support.apple.com/en-us/126346 through https://support.apple.com/en-us/126350).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6708
Vulnerability details
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app…
more
may be able to break out of its sandbox.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape via permissions flaw (CWE-284) directly maps to exploitation for local privilege escalation on Apple platforms.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces the additional permission restrictions Apple applied to prevent sandbox escape.
Requires limiting each app to only the privileges needed for its function, blocking the unauthorized cross-sandbox access.
Provides the process isolation mechanism whose failure allowed the app to break out of its sandbox.