CVE-2026-20700

Exploited before a patch existed (Apple: “may have been exploited”).

Export this CVE's branch rows: CSV · JSON · Permalink: /cve/CVE-2026-20700

First fix

2026-02-11 (iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3)

CISA KEV added

2026-02-12 (1 day after the first fix)

NVD published

2026-02-11 (same day)

First fix: The release date of the earliest Apple update (including Rapid Security Responses and Background Security Improvements) whose advisory lists the CVE.

KEV date added (proxy): CISA KEV “date added” is when CISA catalogued evidence of exploitation. It is a lagging proxy: exploitation started on or before that date, usually well before.

Fix per branch

Backport gap: For one CVE and one branch: the branch's first fix date minus the earliest fix date across all branches of the same platform.

No fix listed: The branch is still maintained (it shipped a security update after the earliest fix, or its last security update is under 180 days old), but no Apple advisory lists this CVE for it as of the data date. The branch may be unaffected; Apple does not publish “not affected” statements.

Branch ended: The branch shipped no security update after the earliest fix and none in the 180 days before the data date, so it is treated as ended and not counted as missing a backport. Updates without published CVE entries do not keep a branch alive.

Fixed at branch release: The branch was first released after the earliest fix, so it is not a backport and is not counted. “Listed”: its advisory names the CVE. “Inherited”: it does not, and the fix is assumed to be in the branch from its first release.

Every Apple listing

Each release whose advisory lists CVE-2026-20700, with Apple's own notes.