CVE-2026-20628
Published: 11 February 2026
Summary
CVE-2026-20628 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
By automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Requiring prior authorization for each remote access type prevents improper access control over remote connections.
Requiring authorization of wireless access before allowing connections enforces proper access control for this access method.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Sandbox escape via permissions flaw (CWE-284) directly maps to exploitation for local privilege escalation on Apple platforms.
NVD Description
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An app…
more
may be able to break out of its sandbox.
Deeper analysisAI
CVE-2026-20628 is a permissions issue, classified under CWE-284, that enables an app to break out of its sandbox on Apple operating systems. The vulnerability affects iOS and iPadOS prior to versions 18.7.5 and 26.3, macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, tvOS prior to 26.3, visionOS prior to 26.3, and watchOS prior to 26.3. It received a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with low attack complexity but requiring local access and user interaction.
A local attacker with no privileges can exploit this vulnerability by tricking a user into interacting with a malicious app, such as opening or using it. Successful exploitation allows the app to escape its sandbox, potentially granting access to sensitive data or system resources outside its intended isolation, leading to unauthorized read/write operations on user files or other protected areas without affecting availability.
Apple's security advisories detail that the issue was addressed by adding additional restrictions to permissions handling. Mitigation requires updating to the fixed versions: iOS 18.7.5 or 26.3, iPadOS 18.7.5 or 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, or watchOS 26.3. Further details are available in the referenced support pages (https://support.apple.com/en-us/126346 through https://support.apple.com/en-us/126350).
Details
- CWE(s)