CVE-2026-20699

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Apple	macOS	< 14.8.5; < 15.7.5; < 26.3; < 26.4

References

https://support.apple.com/en-us/126348Release Notes, Vendor Advisory
https://support.apple.com/en-us/126794Release Notes, Vendor Advisory
https://support.apple.com/en-us/126795Release Notes, Vendor Advisory
https://support.apple.com/en-us/126796Release Notes, Vendor Advisory

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-20708.8A vulnerability has been found in UTT 进取 520W 1.7.7-180627. The affected element is the function strcpy of the file /goform/formPolicyRouteC CVE-2026-207007.8A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, t CVE-2026-207017.5An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS CVE-2026-2070210.0Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivil CVE-2026-207035.4Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unpr CVE-2026-207045.1Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the CVE-2026-207055.3Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow inform CVE-2026-207069.1Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoi CVE-2026-207075.6Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivileged software may allow CVE-2026-207085.9Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an info CVE-2026-207096.6Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Serie CVE-2026-20718.8A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. P