This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apple fixes over 70 vulnerabilities

Apple fixes more than 70 vulnerabilities in its products, of which CVE-2026-20700 is already being actively exploited. A description of selected most severe vulnerabilities can be found below; the remaining ones are described on the vendor's website [1]. Products and their fixed versions: macOS - Tahoe 26.3 [2], Sequoia 15.7.4 [3], Sonoma 14.8.4 [4] iOS - 26.3 [5], 18.7.5 [6] iPadOS - 26.3 [5], 18.7.5 [6] tvOS - 26.3 [7] watchOS - 26.3 [8] visionOS - 26.3 [9] Safari - 26.3 [10]

Apple macOS Tahoe, Sonoma, visionOS, iOS, iPadOS - sandbox escape (CVE-2026-20677)
CVSS 9.0 (Critical)

Allows an unauthenticated remote attacker to bypass sandbox restrictions in Messages on macOS (Tahoe, Sonoma), visionOS, iOS and iPadOS [11].

The vulnerability is present in products:

  • iPadOS; <18.7.5; >=26, <26.3;
  • iOS; <18.7.5; >=26, <26.3;
  • macOS; <14.8.4; >=26, <26.3;
  • visionOS; <26.3;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 11. 2. 2026.

Apple macOS Tahoe, Sequoia, Sonoma, watchOS, iPadOS, iOS - sandbox escape (CVE-2026-20667)
CVSS 8.8 (High)

Allows an authenticated local attacker to bypass sandbox restrictions due to a logic error in libxpc on macOS (Tahoe, Sequoia, Sonoma), watchOS, iOS and iPadOS [12].

The vulnerability is present in products:

  • iPadOS; >=26, <26.3;
  • iOS; >=26, <26.3;
  • macOS; <14.8.4; >=15, <15.7.4; >=26, <26.3;
  • watchOS; <26.3;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 11. 2. 2026.

Apple macOS Tahoe, tvOS, watchOS, visionOS, iPadOS, iOS - memory corruption, code execution (CVE-2026-20700)
CVSS 7.8 (High)

Allows an authenticated local attacker with the ability to write data to memory to corrupt memory and execute code in macOS Tahoe, tvOS, watchOS, visionOS, iPadOS and iOS [13]. The vulnerability is already being exploited in sophisticated attacks against specifically targeted individuals [13][14].

The vulnerability is present in products:

  • iPadOS; <26.3;
  • iOS; <26.3;
  • macOS; <26.3;
  • tvOS; <26.3;
  • visionOS; <26.3;
  • watchOS; <26.3;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-20700 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 19. 2. 2026.

CESNET, z.s.p.o. Logo