Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-20677 is a critical-severity Race Condition (CWE-362) vulnerability in Apple Ipados. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20677 is a race condition vulnerability in the handling of symbolic links, which allows a shortcut to bypass sandbox restrictions. The issue affects Apple's iOS and iPadOS prior to versions 18.7.5 and 26.3, macOS Sonoma prior to 14.8.4, macOS Tahoe prior to 26.3, and visionOS prior to 26.3. It is associated with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-367 (Path Traversal: '..' and Absolute Path Equivalence Error), and carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
A remote attacker with no privileges or user interaction can exploit this vulnerability over the network, though it requires high attack complexity. Successful exploitation enables a shortcut to evade sandbox protections, potentially granting elevated access and resulting in high-impact confidentiality, integrity, and availability violations across a changed scope.
Apple's security advisories detail the fix through improved symbolic link handling in the listed patched versions. Mitigation involves updating to iOS 18.7.5 or 26.3, iPadOS 18.7.5 or 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, or visionOS 26.3. Additional details are available in the vendor's security content updates at https://support.apple.com/en-us/126346, https://support.apple.com/en-us/126347, https://support.apple.com/en-us/126348, https://support.apple.com/en-us/126350, and https://support.apple.com/en-us/126353.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6233
Vulnerability Data
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut may be able to…
more
bypass sandbox restrictions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.2V10.4.5V15.1.3V15.4.1
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.
Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.
Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.