CVE-2026-20627

Published Feb 11, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, watchOS 26.3. An app may be able to access sensitive user data.

Analysis

Technical impact

An Environment Variable handling vulnerability was discovered in Apple operating systems. The flaw allows an application to read environment variables without adequate validation, potentially exposing sensitive user data. This issue is categorized as CWE‑20: Improper Input Validation.

Affected Systems

Apple iOS, iPadOS, macOS, visionOS, and watchOS are affected. Fixed releases include iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4 or macOS Tahoe 26.3, visionOS 26.3, and watchOS 26.3. Devices running earlier releases are vulnerable.

Risk and Exploitability

The CVSS score of 5.5 classifies this flaw as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of environment variable access, the likely attack vector is local, where an application with sufficient privileges can read system or user environment variables. No remote exploitation path is documented in the provided information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 26.3

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.4
`0`	affected	< 15.7.4
`0`	affected	< 26.3

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.3

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.3

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Versions

Apple

Ios And Ipados

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Macos

Version	Status	Scheme	Platform
`[0,14.8)`	affected	generic	—

Apple

Visionos

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Apple

Watchos

Version	Status	Scheme	Platform
`[0,26.3)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update all Apple devices to the latest OS releases, including iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, and watchOS 26.3.
Implement application‑level input validation to ensure environment variables are sanitized before use.
Apply the latest security updates from Apple promptly and monitor for new advisories.

Generated by OpenCVE AI on August 22, 2026 at 11:49 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.173% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/126346
https://support.apple.com/en-us/126348
https://support.apple.com/en-us/126349
https://support.apple.com/en-us/126350
https://support.apple.com/en-us/126352
https://support.apple.com/en-us/126353

History

Aug 22, 2026 12:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Improper Environment Variable Validation Exposes Sensitive Data

Aug 21, 2026 1:00 AM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, watchOS 26.3. An app may be able to access sensitive user data.	An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, watchOS 26.3. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/126349

Apr 16, 2026 1:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Environment Variable Validation Exposes Sensitive Data

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.	An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, watchOS 26.3. An app may be able to access sensitive user data.

Feb 13, 2026 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple ipados Apple iphone Os
CPEs		cpe:2.3:o:apple:ipados:::::::: cpe:2.3:o:apple:iphone_os:::::::: cpe:2.3:o:apple:macos:::::::: cpe:2.3:o:apple:visionos:::::::: cpe:2.3:o:apple:watchos::::::::
Vendors & Products		Apple ipados Apple iphone Os

Feb 12, 2026 10:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 12, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple visionos Apple watchos

Feb 11, 2026 11:15 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, visionOS 26.3, iOS 26.3 and iPadOS 26.3. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/126346 https://support.apple.com/en-us/126348 https://support.apple.com/en-us/126350 https://support.apple.com/en-us/126352 https://support.apple.com/en-us/126353