CVE-2026-20649
Apple Ipados ≤ 26.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-20649 is a high-severity Insecure Temporary File (CWE-377) vulnerability in Apple Ipados. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20649 is a logging vulnerability stemming from insufficient data redaction in Apple's operating systems. Affected components include iOS and iPadOS prior to version 26.3, macOS Tahoe prior to 26.3, tvOS prior to 26.3, and watchOS prior to 26.3. The issue allows sensitive user information to be exposed through logs, as indicated by CWE-377 (Insecure Temporary File) and NVD-CWE-noinfo mappings. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact with network accessibility and low attack complexity.
A remote, unauthenticated attacker can exploit this vulnerability over the network without requiring user interaction or privileges. Successful exploitation enables the attacker to access sensitive user information logged without proper redaction, potentially leading to privacy violations such as exposure of personal data.
Apple's security advisories detail the fix as improved data redaction in logging mechanisms, available in iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, and watchOS 26.3. Practitioners should prioritize updating affected devices to mitigate exposure of sensitive information in logs. Relevant advisories are published at https://support.apple.com/en-us/126346, https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126351, and https://support.apple.com/en-us/126352.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7375
Vulnerability Data
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user may be able to view sensitive user information.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces file-system access authorizations so that temporary files cannot be read or modified by unauthorized processes.
AC-6 reduces the privileges available to processes that create or access temporary files, limiting blast radius if a file is predictable or left readable.
SC-4 directly stops unauthorized information leakage through shared resources such as world-writable temporary directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding insecure temp-file creation patterns.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect insecure temporary files but does not prevent their creation.
Secure development life cycle mandates secure handling of temporary files during design and coding.
Application security requirements can specify secure temporary-file creation and access controls.
Secure system architecture principles discourage insecure temporary-file patterns but do not directly address them.
Secure coding standards explicitly require safe temporary-file APIs and permissions.
Information deletion policies may cover secure removal of temporary files after use.