Critical severity9.0NVD Advisory· Published Feb 11, 2026· Updated Aug 21, 2026
CVE-2026-20677
CVE-2026-20677
Description
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3. A shortcut may be able to bypass sandbox restrictions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*range: <18.7.5
- (no CPE)range: 18.7.5, 26.3
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*range: <26.3
- (no CPE)range: 26.3
- Range: 18.7.5, 26.3
- Range: 15.7.4
- Range: 14.8.4
- Range: 26.3
Patches
Vulnerability mechanics
References
6- support.apple.com/en-us/126346nvdRelease NotesVendor Advisory
- support.apple.com/en-us/126347nvdRelease NotesVendor Advisory
- support.apple.com/en-us/126348nvdRelease NotesVendor Advisory
- support.apple.com/en-us/126350nvdRelease NotesVendor Advisory
- support.apple.com/en-us/126353nvdRelease NotesVendor Advisory
- support.apple.com/en-us/126349nvd
News mentions
0No linked articles in our index yet.