CVE-2026-20677 is a critical race condition (CVSS 9.0) in Apple iOS, iPadOS, macOS and visionOS. A shortcut may be able to bypass sandbox restrictions through mishandled symbolic links. Apple fixed it in iOS and iPadOS 26.3 and 18.7.5, macOS Tahoe 26.3, Sequoia 15.7.4, Sonoma 14.8.4 and visionOS 26.3.
What's affected
Apple lists these fixed releases for CVE-2026-20677:
- iOS 26.3 and iPadOS 26.3, and iOS 18.7.5 and iPadOS 18.7.5
- macOS Tahoe 26.3, macOS Sequoia 15.7.4 and macOS Sonoma 14.8.4
- visionOS 26.3
The record says the issue is a race condition addressed with improved handling of symbolic links. The weaknesses are classed as CWE-362 (race condition) and CWE-367 (time of check to time of use). The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The high attack complexity reflects that winning a race is not guaranteed, and the changed scope reflects that the sandbox boundary is the thing at risk.
The record does not mark this as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. Any release older than the ones above on a supported branch should be treated as affected.
How to check if you're exposed
On an iPhone or iPad, open Settings, then General, then About, and read the iOS version. Compare it with the fixed releases above for your device branch. Devices that cannot run iOS 26 may still receive 18.7.5.
On a Mac, check from the terminal.
sw_vers -productVersion
Compare the output with 26.3 for Tahoe, 15.7.4 for Sequoia or 14.8.4 for Sonoma. On Apple Vision Pro, open Settings, then General, then About.
For a fleet, your mobile device management tool should report OS version per device. Filter for anything below the fixed release for its branch. Apple lists the fixes on its own security content pages, linked below.
What to do now
- Update every iPhone, iPad, Mac and Vision Pro to the fixed release for its branch. Use Software Update on the device, or your device management tool for a fleet.
- Where devices cannot update to the latest major version, move them to the newest release on their branch: iOS 18.7.5, macOS Sequoia 15.7.4 or macOS Sonoma 14.8.4.
- Report on devices still below the fixed version after a week and chase the owners.
- Review which shortcuts and automations run on managed devices, and remove any you do not recognise or no longer need.
- Keep automatic updates on for personal and managed devices so the next fix arrives without a project.
Why it matters
A sandbox is the boundary that stops one app, or one script, from reaching everything else on the device. Escaping it is what turns a limited foothold into broad access. That is why the scope in the vector is marked as changed and the impact is scored high on confidentiality, integrity and availability, even though the attack is hard to pull off.
The cause is a race condition tied to symbolic links. A program checks something about a path, and then acts on the path a moment later. If a link changes in between, the check and the action no longer refer to the same thing. This class is known as time of check to time of use. The usual fix is to make the check and the use a single step, which is what Apple describes as improved handling of symbolic links.
The score is critical, but the practical risk depends on whether someone can get a malicious shortcut onto your device. Shortcuts arrive by sharing links and files, so the same habits apply as for any unknown file: do not run what you did not inspect. The reliable fix is still the update.
Apple does not publish technical detail about issues it fixes, and neither does this post. If you run a mixed fleet, treat the OS version as your inventory key. The Safeguard vulnerability management demo shows how version data turns into a prioritised fix list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to update if I never use Shortcuts?
Update anyway. The fix ships inside the OS release along with many other security fixes, and a device on an old release stays exposed to the rest of them.
Is this being exploited?
The record does not say so, and CISA does not list it as exploited. That can change, so check the CISA catalog if you need to be sure on the day you read this.
Sources
- About the security content of iOS 26.3 and iPadOS 26.3
- About the security content of iOS 18.7.5 and iPadOS 18.7.5
- About the security content of macOS Tahoe 26.3
- NVD record for CVE-2026-20677
Last reviewed: 19 October 2026.
