In CISA KEVNot scored
CVE-2026-20700
Apple Multiple Buffer Overflow Vulnerability
AppleMultiple Products
Status
- Exploited in the wild
- In CISA KEV since 12 Feb
- Vendor fix available
Federal deadlineThu 5 Mar, 23:59 UTC
Passed 233 days ago
CISA KEV · added 12 Feb
Exploit probabilityEPSSchecked 25 Oct
1.7%probability of exploitation in the next 30 days
Higher than 77% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 10 articles · 5 outlets
See the full timelineShow as table
- DarkSword emerges as powerful iOS exploit tool in global attacksSecurity Affairs
- A DarkSword hangs over unpatched iPhonesMalwarebytes
- DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device TakeoverThe Hacker News
- Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI MalwareThe Hacker News · mentions it in passing
- U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Apple patches zero-day flaw that could let attackers take control of devicesMalwarebytes
- Apple fixed first actively exploited zero-day in 2026Security Affairs
- Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’SecurityWeek
- Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple DevicesThe Hacker News
- Apple Zero-Day (CVE-2026-20700) Exploited in the WildSecurityOnline · first in our coverage