Security readout for executives and security teams
Plain-English summary
Apple fixed a flaw in macOS where a malicious app could sidestep Gatekeeper, the safety check that warns users before running untrusted software. An attacker would still need a user to download and open something on a Mac. Apple released a fix in macOS Tahoe 26.4, and Macs that have applied that update are protected.
Executive priority
Low business urgency. Patch on the next standard macOS maintenance cycle. The flaw is local, low severity, and not known to be exploited, but Gatekeeper is a core trust boundary on Mac, so do not allow the update to slip indefinitely on executive or developer laptops.
Technical view
CVE-2026-20684 is an improper access control weakness (CWE-284) in macOS where insufficient permission restrictions allowed an app to bypass Gatekeeper signature and notarization checks. CVSS 3.1 base score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), reflecting local vector, required user interaction, and limited integrity impact. Apple addressed the issue with additional restrictions in macOS Tahoe 26.4.
Likely exposure
Any Mac fleet running macOS versions prior to Tahoe 26.4 is potentially exposed. Exposure is concentrated on endpoints where users can download and launch third-party applications, particularly developer workstations, executive laptops, and BYOD Macs that sit outside MDM-enforced application allowlists.
Exploitation context
No public reports of active exploitation are cited in the source bundle, and the CVE is not listed in CISA KEV. Exploitation requires local delivery of a malicious app and user interaction to launch it, which limits opportunistic abuse but is plausible in targeted social-engineering or supply-chain delivery scenarios.
Researcher notes
Apple's advisory describes the fix as "additional restrictions" without naming the specific subsystem, so root-cause detail is limited from public sources. CVSS reflects local vector and integrity-only impact, consistent with a trust-bypass rather than code execution. Watch for follow-up research that ties this CVE to a specific Gatekeeper or quarantine attribute weakness.
Mitigation direction
- Update affected Macs to macOS Tahoe 26.4 or later per Apple's HT126794 advisory.
- Enforce the macOS update through MDM (Jamf, Intune, Kandji) with a defined compliance deadline.
- Require Gatekeeper to remain enabled and restrict unsigned application execution via policy.
- Limit installation of software from outside the App Store or approved distribution channels.
- Pair Gatekeeper with endpoint protection that flags unsigned or unnotarized binaries at launch.
Validation and detection
- Inventory Macs and confirm OS build is at or above macOS Tahoe 26.4.
- Pull MDM compliance reports to identify endpoints still on vulnerable macOS versions.
- Verify Gatekeeper is enabled and configured to block unsigned apps fleet-wide.
- Review EDR telemetry for anomalous app launches that bypassed Gatekeeper prompts.
- Spot-check executive and developer endpoints, which are most likely to disable Gatekeeper warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-20684 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N1.81.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://support.apple.com/en-us/126794CVE reference, apple
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.