PT-2026-7800 · Apple · Ipados+3

Ron Masas · Published 2026-02-11 · Updated 2026-02-24 · CVE-2026-20677

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple macOS versions prior to Tahoe 26.3 Apple macOS versions prior to Sonoma 14.8.4 Apple iOS versions prior to 18.7.5 Apple iPadOS versions prior to 18.7.5 Apple visionOS versions prior to 26.3 Apple iOS versions prior to 26.3 Apple iPadOS versions prior to 26.3

Description A race condition existed in the handling of symbolic links. This allowed a shortcut to potentially bypass sandbox restrictions.

Recommendations Update Apple macOS to version 26.3 or later. Update Apple macOS to version 14.8.4 or later. Update Apple iOS to version 18.7.5 or later. Update Apple iPadOS to version 18.7.5 or later. Update Apple visionOS to version 26.3 or later. Update Apple iOS to version 26.3 or later. Update Apple iPadOS to version 26.3 or later.

Fix

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-367

CWE-362

Related Identifiers

CVE-2026-20677

Affected Products

Apple Macos

Ios

Ipados

Visionos

References · 15

• https://support.apple.com/en-us/126348 · Vendor Advisory
• https://support.apple.com/en-us/126347 · Vendor Advisory
• https://support.apple.com/en-us/126353 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/728988 · Security Note
• https://support.apple.com/en-us/126346 · Vendor Advisory
• https://support.apple.com/en-us/126350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-20677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20677 · Security Note
• https://t.me/poxek/5911 · Telegram Post
• https://twitter.com/wazuh/status/2026277377463001192 · Twitter Post
• https://twitter.com/wazuh/status/2026372903198142683 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20677 · Note
• https://twitter.com/CVEnew/status/2021799487262572598 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021808147577360718 · Twitter Post
• https://t.me/CVEtracker/44490 · Telegram Post