CVE-2026-20700

A flaw in the software that helps Apple devices handle graphics can let a highly capable attacker take control of a device. Think of it as a damaged lock inside the device: once someone has access to the right internal mechanism, they may be able to open every door.

This matters to you if your business uses Apple operating systems on iPhones, iPads, Macs, Apple TVs, Vision Pro headsets, or Apple Watches. It is only a risk if an attacker already has low-level access that lets them write to the device’s memory.

Attackers have already used this vulnerability in highly sophisticated targeted attacks, and it is listed by CISA as a known exploited vulnerability. Treat this as urgent: update business devices that have not reached version 26.3, especially devices used for sensitive work.

Confirm exposure by inventorying managed Apple devices and collecting their installed OS versions. The remediation target is 26.3 for iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS.

Deploy Apple’s normal OS updates through device management where available, then verify installation status and investigate devices that fail or remain offline. The findings do not identify a breaking-change concern; test the update first only where your business has a required compatibility process.

No vendor workaround is provided in the findings. If an update must be delayed, prioritize limiting access to the affected device, particularly administrator and high-value user devices, until the update can be installed. CISA’s remediation due date was 2026-03-05.

Monitor device-management update compliance, endpoint security alerts, and reports of unexpected application or device behavior. There is no public exploit code on record, but confirmed targeted exploitation means failed-update exceptions deserve prompt follow-up.

Severity: CVSS 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-119 memory corruption, described as an out-of-bounds write in CoreGraphics caused by inadequate state management. The attack vector is local, requires low privileges, and requires no user interaction; CORE further identifies memory-write capability on the target as a precondition. CISA added CVE-2026-20700 to the Known Exploited Vulnerabilities catalog on 2026-02-12, confirming real-world exploitation and establishing the 2026-03-05 remediation due date. Apple reported exploitation in extremely sophisticated targeted attacks; no public exploit code is recorded.