CVE-2026-20660: 
Apple Safari vulnerability analysis and mitigation

CVE-2026-20660 is a path traversal vulnerability (CWE-22) in Apple's CFNetwork framework that allows a remote user to write arbitrary files on affected systems. It was discovered by Amy (amys.website) and disclosed on February 11, 2026, as part of Apple's security updates. Affected products include Safari (before 26.3), iOS and iPadOS (before 18.7.5 and before 26.3), macOS Sonoma (before 14.8.4), macOS Sequoia (before 15.7.5), macOS Tahoe (before 26.3), and visionOS (before 26.3). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Apple iOS 26.3 Advisory, Apple Safari 26.3 Advisory, Apple macOS Sequoia Advisory).

The vulnerability is rooted in improper path handling logic within Apple's CFNetwork framework (CWE-22: Path Traversal). Insufficient validation of file path inputs allows a remote attacker to craft requests that escape the intended directory boundary and write files to arbitrary locations on the filesystem. The attack is network-based, requires no authentication, no privileges, and no user interaction, making it particularly dangerous. Apple addressed the issue by implementing improved path handling logic in the affected CFNetwork component (Apple iOS 26.3 Advisory, Apple Safari 26.3 Advisory, Apple macOS Sequoia Advisory).

Successful exploitation allows an unauthenticated remote attacker to write arbitrary files to the affected device's filesystem, directly impacting integrity. While confidentiality and availability are not directly impacted per the CVSS assessment, arbitrary file write primitives can be chained with other vulnerabilities to achieve code execution, persistence, or privilege escalation. The broad scope of affected platforms — spanning iOS, iPadOS, macOS, Safari, and visionOS — significantly widens the potential attack surface across Apple's ecosystem (Apple iOS 26.3 Advisory, Apple macOS Sequoia Advisory).

Apple has released patches across all affected platforms. Users should update to the following versions or later: Safari 26.3, iOS 18.7.5 or iOS 26.3, iPadOS 18.7.5 or iPadOS 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.5, macOS Tahoe 26.3, and visionOS 26.3. No configuration-based workarounds have been published; updating to a patched version is the only recommended remediation. Enabling automatic software updates on all Apple devices is strongly advised to ensure timely protection (Apple iOS 26.3 Advisory, Apple Safari 26.3 Advisory, Apple macOS Sequoia Advisory).

The vulnerability was noted in broader coverage of Apple's February 2026 security update cycle, which addressed over 90 vulnerabilities across macOS, iOS, and iPadOS. Security news outlets and community feeds highlighted the update batch, with social media posts from accounts such as The Hacker Wire on Mastodon and Bluesky drawing attention to the release. The SANS Internet Storm Center also covered the February and March 2026 Apple update rounds (SANS ISC Feb, SANS ISC Mar).