CVE-2026-20685

MEDIUM

Apple Private Cloud Compute Server Software < 5E290.3 - Improper Input Validation

Title source: rule

Description

An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issue is fixed in PCC Release 5E290.3.

References (1)

Core 1

Core References

https://security.apple.com/documentation/private-cloud-compute/releasenotes#darwin-init

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 11.4%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-20 CWE-22

Status published

Products (1)

Apple/Private Cloud Compute Server Software < 5E290.3

Published May 18, 2026

Tracked Since May 18, 2026