This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Apple
  • Ios And Ipados
  • Ipados
  • Iphone Os
  • Macos

Configuration 1 [-]

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.spirityenterprise.com/managed-detection-response spirity
https://support.apple.com/en-us/126346 cve-icon cve-icon
https://support.apple.com/en-us/126348 cve-icon cve-icon
https://support.apple.com/en-us/126349 cve-icon cve-icon
https://support.apple.com/en-us/126350 cve-icon cve-icon
https://support.apple.com/en-us/126794 cve-icon cve-icon
https://support.apple.com/en-us/126795 cve-icon cve-icon
https://support.apple.com/en-us/126796 cve-icon cve-icon
History

Thu, 26 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
Weaknesses CWE-59
CWE-61
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Title Symlink Handling Enables App to Access User Sensitive Data
Weaknesses CWE-200

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Symlink Exploit Enables Apps to Access Sensitive User Data
Weaknesses CWE-200
CWE-22

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Symlink Exploit Enables Apps to Access Sensitive User Data
Weaknesses CWE-200
CWE-22

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Apple macos
Vendors & Products Apple
Apple ios And Ipados
Apple macos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-03-26T19:23:21.098Z

Reserved: 2025-11-11T14:43:07.876Z

Link: CVE-2026-20694

cve-icon Vulnrichment

Updated: 2026-03-26T19:23:17.407Z

cve-icon NVD

Status : Modified

Published: 2026-03-25T01:17:06.217

Modified: 2026-03-26T20:16:09.393

Link: CVE-2026-20694

cve-icon Redhat

No data.