CVE-2026-20672 Overview
CVE-2026-20672 is an information disclosure vulnerability affecting Apple macOS Sequoia and macOS Sonoma. The flaw allows a locally installed application to access sensitive user data due to insufficient privacy controls. Apple addressed the issue by strengthening privacy enforcement in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. The weakness is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
A malicious or misbehaving application installed on a vulnerable macOS system can read sensitive user data without authorization, undermining privacy boundaries enforced by the operating system.
Affected Products
- Apple macOS Sequoia versions prior to 15.7.8
- Apple macOS Sonoma versions prior to 14.8.8
- Applications running on affected macOS installations that rely on system privacy controls
Discovery Timeline
- 2026-07-27 - CVE-2026-20672 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-20672
Vulnerability Analysis
The vulnerability exists in the privacy control layer of macOS Sequoia and Sonoma. An application running with standard user privileges can bypass privacy restrictions and read data that should remain isolated behind Apple's Transparency, Consent, and Control (TCC) framework or equivalent access controls.
Exploitation requires local code execution on the target system and some form of user interaction. No elevated privileges are required for the attacking process, which increases the risk from sideloaded or seemingly benign third-party applications. The impact is limited to confidentiality; system integrity and availability are not affected.
Apple addressed the issue by tightening the privacy enforcement paths in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. Users running earlier releases in these branches remain exposed until the update is applied.
Root Cause
The root cause is inadequate privacy controls that fail to gate access to sensitive user data. The affected code path did not fully validate that the requesting application held the required entitlements or user consent before returning protected information. This category of defect maps to [CWE-200].
Attack Vector
The attack vector is local. An attacker must deliver and execute an application on the target macOS device. Delivery paths include trojanized installers, malicious App Store applications, supply-chain compromise of legitimate software, or social engineering that leads a user to run the payload. Once running, the application invokes the vulnerable API surface to retrieve data it should not be able to see.
No verified public exploit code or proof-of-concept is available for CVE-2026-20672. Refer to Apple Security Advisory 128071 and Apple Security Advisory 128072 for vendor-supplied technical context.
Detection Methods for CVE-2026-20672
Indicators of Compromise
- Unsigned or ad-hoc signed applications launching from user-writable locations such as ~/Downloads, ~/Library, or /tmp
- Unexpected TCC prompt denials or bypasses recorded in the unified log subsystem com.apple.TCC
- Applications reading files under ~/Library/Application Support, ~/Library/Messages, or ~/Library/Mail without corresponding user consent
- Outbound network connections from newly installed applications shortly after they access user data directories
Detection Strategies
- Inventory macOS endpoints and flag any running versions earlier than 15.7.8 (Sequoia) or 14.8.8 (Sonoma)
- Correlate process execution telemetry with file access events targeting protected user data paths
- Alert on applications that access sensitive directories without a matching TCC authorization event
Monitoring Recommendations
- Enable and centralize Endpoint Security framework telemetry, including ES_EVENT_TYPE_NOTIFY_OPEN on privacy-sensitive paths
- Monitor installations of new applications, especially those distributed outside the Mac App Store or Apple notarization
- Track macOS software version compliance in asset management to confirm patch adoption across the fleet
How to Mitigate CVE-2026-20672
Immediate Actions Required
- Upgrade all macOS Sequoia systems to version 15.7.8 or later without delay
- Upgrade all macOS Sonoma systems to version 14.8.8 or later without delay
- Audit installed third-party applications and remove any that are unnecessary or from untrusted sources
- Restrict user ability to install unsigned or non-notarized applications through configuration profiles
Patch Information
Apple released fixes in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. Details are published in Apple Security Advisory 128071 and Apple Security Advisory 128072. Administrators should distribute the update through Mobile Device Management (MDM) tooling and verify installation on each endpoint.
Workarounds
- Limit application execution to notarized software using Gatekeeper policies enforced by MDM
- Reduce the sensitive data stored in user profiles on shared or high-risk endpoints until patched
- Apply the principle of least privilege by using standard user accounts rather than administrator accounts for daily work
# Verify installed macOS version and confirm the patch is applied
sw_vers -productVersion
# Trigger an MDM-managed software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
