CVE-2026-20674: Apple iPadOS Information Disclosure Flaw

CVE-2026-20674 Overview

CVE-2026-20674 is a privacy vulnerability affecting Apple iOS and iPadOS. An attacker with physical access to a locked device may be able to view sensitive user information. Apple addressed the issue by removing sensitive data from the affected interface. The flaw is categorized under [CWE-200] Information Exposure and requires physical access to the target device.

Apple released fixes in iOS 26.3 and iPadOS 26.3. The vulnerability does not allow code execution or data modification, but it can leak user information from a device that should otherwise be protected by the lock screen.

Critical Impact
An attacker with physical possession of a locked iPhone or iPad can view sensitive user information without unlocking the device.

Affected Products

Apple iOS (versions prior to 26.3)
Apple iPadOS (versions prior to 26.3)
Devices supported by iOS 26 and iPadOS 26 release trains

Discovery Timeline

2026-02-11 - CVE-2026-20674 published to NVD
2026-02-13 - Last updated in NVD database

Technical Details for CVE-2026-20674

Vulnerability Analysis

The vulnerability is an information disclosure issue on locked Apple mobile devices. Apple's advisory states the issue was addressed by removing sensitive data from the exposed surface. The weakness maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Exploitation requires physical access to the target device, which significantly narrows the threat model. The lock screen typically restricts what information a non-authenticated user can see. In this case, certain information was reachable without unlocking the device.

The vulnerability does not affect data integrity or device availability. Confidentiality is the only security property impacted. According to EPSS data, the probability of exploitation in the wild is very low.

Root Cause

The root cause is improper handling of sensitive data on the lock screen interface. Specific user information was rendered or accessible in a context that should have required authentication. Apple's fix removes the sensitive data from that surface rather than gating access behind additional authentication checks.

Apple has not published deeper technical specifics about which component exposed the data. Reference the Apple Support Advisory for vendor-confirmed details.

Attack Vector

An attacker must have physical possession of an unlocked-state-targeted device that is currently locked. The attacker interacts with the lock screen or related interface to surface the sensitive information. No network access, user interaction by the victim, or prior privileges are required.

Typical scenarios include lost or stolen devices, brief unattended access in shared environments, or border and customs inspection contexts. No verified public proof-of-concept is available for this CVE.

Detection Methods for CVE-2026-20674

Indicators of Compromise

No network-based indicators exist because exploitation occurs locally on a locked device.
Reports of physical device tampering, loss, or unauthorized handling should be treated as potential exposure events.
Mobile Device Management (MDM) logs showing devices running iOS or iPadOS versions prior to 26.3.

Detection Strategies

Use MDM inventory queries to identify devices that have not upgraded to iOS 26.3 or iPadOS 26.3.
Correlate device loss or theft reports with the patch status of the affected device.
Audit Apple Business Manager and MDM compliance dashboards for non-compliant OS versions.

Monitoring Recommendations

Enforce MDM compliance policies that flag devices running vulnerable iOS or iPadOS builds.
Monitor Apple ID sign-in activity and iCloud access for accounts associated with lost devices.
Track Find My device activity and remote-wipe events to confirm response to physical exposure incidents.

How to Mitigate CVE-2026-20674

Immediate Actions Required

Update all iPhone devices to iOS 26.3 and all iPad devices to iPadOS 26.3.
Prioritize patching for devices used by executives, field staff, and other high-risk users with elevated travel exposure.
Re-validate lock screen configuration policies through MDM after the upgrade.

Patch Information

Apple fixed CVE-2026-20674 in iOS 26.3 and iPadOS 26.3 by removing the sensitive data from the affected interface. Refer to the Apple Support Advisory for the official release notes and supported device list. Deploy the update through Apple Software Update, MDM commands, or end-user prompts.

Workarounds

Restrict lock screen widgets, notifications, Siri, and Control Center features through MDM until devices are patched.
Require strong passcodes and enable biometric authentication to reduce dwell time of unauthorized physical access.
Enable Find My iPhone and remote wipe capabilities for all managed devices to limit data exposure on loss.
Educate users on physical device security and immediate reporting of lost or stolen devices.

bash

# Example MDM command to enforce iOS update via Apple's MDM protocol
# Schedule OS update to iOS/iPadOS 26.3 on supervised devices
mdmctl command ScheduleOSUpdate \
  --product-key iOS26.3 \
  --install-action InstallForceRestart \
  --device-udid <DEVICE_UDID>