Path Handling Vulnerability in Apple Private Cloud Compute
CVE-2026-20685

6.5MEDIUM

Key Information:

Vendor

Apple
Status
Private Cloud Compute Server Software
Vendor
CVE Published:
18 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-20685?

A path handling issue in Apple Private Cloud Compute may allow attackers positioned within a privileged network to exploit the vulnerability and leak sensitive information. This potential security weakness has been addressed with improved validation in PCC Release 5E290.3, enhancing the overall protection against unauthorized access to sensitive data.

Affected Version(s)

Private Cloud Compute Server Software 0 < 5E290.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-20685
Created by HORKimhab

References

https://security.apple.com/documentation/private-cloud-co...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.