Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-20685: An attacker in a privileged network position may be able to leak sensitive information

CVE-2026-20685 is a medium-severity (CVSS 6.5) path handling vulnerability in Apple's Private Cloud Compute (PCC), classified under CWE-20 and CWE-22, that could let an attacker in a privileged network position leak sensitive information. Apple addressed the issue with improved path validation, fixed in PCC Release 5E290.3.

TL;DR Network-adjacent path handling flaw in Apple Private Cloud Compute allows info disclosure; fixed in PCC 5E290.3.
Open original ↗

Organisations named here

  • CWE-20

CVEs named here

  • CVE-2026-20685

Technologies named here

  • Apple Private Cloud Compute

Techniques named here

  • Path traversal

Related in AppSec