CVE-2026-20615

Exploited in the Wild

NIST CVSS Scores

CVSS v3.1 Base Score: 7.8 (High)

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA CVSS Scores

CVSS v3.1 Base Score: 7.8 (High)

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Operating Systems Impacted

macOS Tahoe (prior to 26.3)
iOS 26 / iPadOS 26 (prior to 26.3)
visionOS (prior to 26.3)

Additional Resources

NVD CVE-2026-20615

Description

CVE-2026-20615 is a path handling issue within the CoreServices component of macOS. According to Apple's advisory, the flaw could allow an app to gain root privileges. It was reported by Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman).

Impact

Exploitation of this vulnerability could allow a local app to escalate to root privileges on an affected Mac. Apple addressed the issue with improved path validation in macOS Tahoe 26.3.

Stay up to date

Iru's bi-weekly collection of articles, videos, and research to keep IT & Security teams ahead of the curve.

Description

CVE-2026-28951

CVE-2025-30427

CVE-2023-23533

Stay up to date