CVE-2026-20680: 
macOS vulnerability analysis and mitigation

CVE-2026-20680 is a sensitive data exposure vulnerability in Apple's Spotlight component affecting iOS, iPadOS, and macOS. A sandboxed app may be able to access sensitive user data due to insufficient restrictions on the observability of app states. The vulnerability was disclosed on February 11, 2026, and affects iOS/iPadOS before 18.7.5, iOS 26/iPadOS 26 before 26.3, macOS Sonoma before 14.8.4, macOS Sequoia before 15.7.4, and macOS Tahoe before 26.3. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apple iOS 26.3 Advisory, Apple iOS 18.7.5 Advisory, Apple macOS Tahoe Advisory).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and resides in the Spotlight subsystem of Apple operating systems. The root cause is inadequate restrictions on the observability of app states, which allows a sandboxed app to infer or directly access sensitive user data that should be isolated by the sandbox boundary. Exploitation requires local access with low privileges (a sandboxed app running on the device), and no user interaction is needed. Apple addressed the issue by implementing additional restrictions on app state observability (Apple iOS 26.3 Advisory, Apple macOS Sequoia Advisory).

Successful exploitation allows a sandboxed application to access sensitive user data that it should not be permitted to read, resulting in a high confidentiality impact with no integrity or availability impact. The vulnerability's scope is changed (CVSS scope: Changed), meaning the impact extends beyond the sandboxed app's own security domain to affect other components or user data. While lateral movement is not directly enabled, unauthorized access to sensitive data could facilitate further privacy violations or targeted attacks against the user (Apple iOS 18.7.5 Advisory, Apple macOS Tahoe Advisory).

Apple has released patches addressing CVE-2026-20680 across all affected platforms. Users should update to the following versions or later: iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, or macOS Tahoe 26.3. No configuration-based workarounds have been published; updating to a patched release is the only recommended remediation (Apple iOS 18.7.5 Advisory, Apple macOS Sequoia Advisory, Apple macOS Sonoma Advisory).