CVE-2026-20701

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to connect to a network share without user consent.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
Apple	macOS	< 14.8.5; < 15.7.5; < 26.4

References

https://support.apple.com/en-us/126794Release Notes, Vendor Advisory
https://support.apple.com/en-us/126795Release Notes, Vendor Advisory
https://support.apple.com/en-us/126796Release Notes, Vendor Advisory

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-2070210.0Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivil CVE-2026-207035.4Protection mechanism failure for some BigDL before version 2.4.0 within Ring 3: User Applications may allow an escalation of privilege. Unpr CVE-2026-207045.1Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the CVE-2026-207055.3Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow inform CVE-2026-207069.1Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoi CVE-2026-207075.6Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivileged software may allow CVE-2026-207085.9Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an info CVE-2026-207096.6Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Serie CVE-2026-20718.8A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. P CVE-2026-207116.1Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary CVE-2026-207124.0Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System softw CVE-2026-207137.5Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Sys