CVE-2026-20685

{
  "id": "CVE-2026-20685",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-18T16:16:29.570",
  "lastModified": "2026-10-26T13:10:00.140",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker in a privileged network position may be able to leak sensitive information. A path handling issue was addressed with improved validation. This issue is fixed in PCC Release 5E290.3."
    },
    {
      "lang": "es",
      "value": "Un atacante en una posición de red privilegiada podría filtrar información sensible. Un problema de manejo de rutas se abordó con validación mejorada. Este problema está solucionado en la versión PCC 5E290.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apple",
          "product": "Private Cloud Compute Server Software",
          "versions": [
            {
              "version": "0",
              "lessThan": "5E290.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-18T16:02:19.107495Z",
          "id": "CVE-2026-20685",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apple:private_cloud_compute:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5e290.3",
              "matchCriteriaId": "0AA64A4F-A664-42DF-ACD0-DF9F8B630E30"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.apple.com/documentation/private-cloud-compute/releasenotes#darwin-init",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    }
  ]
}