Is CVE-2026-20648 actively exploited?

No active exploitation of CVE-2026-20648 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-20648 be exploited remotely?

No. CVE-2026-20648 requires local access to exploit.

What is the CVSS score of CVE-2026-20648?

CVE-2026-20648 has a CVSS score of 5.5 (MEDIUM) and an EPSS exploitation probability of 0.01%.

HOME VULNERABILITIESCVE-2026-20648

MEDIUM

CVE-2026-20648

CWE-200Published: February 11, 2026· Updated: Feb 13, 2026

5.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.2th

Official Description

A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to access notifications from other iCloud devices.

NVD Source

Technical Analysis

CVE-2026-20648 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.5.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.