Vulnerability intelligence

CVE-2026-20700

Apple Multiple Buffer Overflow Vulnerability

Apple Multiple Products

Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code.

CVSS Score

—

Unrated

EPSS — Exploit Probability

1.3%

Riskier than 69% of all CVEs · checked 2026-09-04

Exploitation

Confirmed in the wild

KEV since 2026-02-12

Remediation

Unconfirmed

Federal deadline 2026-03-05

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-05.

NVD entry CISA KEV

13 articles across 6 outlets · first covered Feb 12, 2026 · latest Mar 19, 2026

Coverage timeline

DarkSword emerges as powerful iOS exploit tool in global attacks
securityaffairs.com · Mar 19, 2026
A DarkSword hangs over unpatched iPhones
www.malwarebytes.com · Mar 19, 2026
DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover
thehackernews.com · Mar 19, 2026
DarkSword: iPhone Exploit Kit Serves Spies & Thieves Alike
www.darkreading.com · Mar 18, 2026
‘DarkSword’ iOS Exploit Kit Used by State-Sponsored Hackers, Spyware Vendors
www.securityweek.com · Mar 18, 2026
Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware
thehackernews.com · Feb 16, 2026
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
thehackernews.com · Feb 13, 2026
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Feb 13, 2026
Apple patches zero-day flaw that could let attackers take control of devices
www.malwarebytes.com · Feb 12, 2026
Apple fixed first actively exploited zero-day in 2026
securityaffairs.com · Feb 12, 2026
Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’
www.securityweek.com · Feb 12, 2026
Apple Fixes Exploited Zero-Day Affecting iOS, macOS, and Apple Devices
thehackernews.com · Feb 12, 2026
Apple Zero-Day (CVE-2026-20700) Exploited in the Wild
securityonline.info · Feb 12, 2026

Related CVEs — Apple

CVE-2026-43748 CVE-2026-65400KEV CVE-2026-65346 CVE-2026-43723 CVE-2026-39868 CVE-2026-39875 CVE-2021-22681KEV CVE-2026-43818