CVE-2026-28865: Apple iPadOS Auth Bypass Vulnerability

CVE-2026-28865 Overview

CVE-2026-28865 is an authentication bypass vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability stems from improper state management in the authentication mechanism, which allows an attacker in a privileged network position to intercept network traffic. Apple has addressed this issue with improved state management across all affected platforms.

Critical Impact

An attacker in a privileged network position may be able to intercept network traffic across iPhones, iPads, Macs, Apple TVs, Apple Vision Pro, and Apple Watches, potentially exposing sensitive user communications and data.

Affected Products

• Apple iOS (versions prior to 18.7.7 and 26.4)
• Apple iPadOS (versions prior to 18.7.7 and 26.4)
• Apple macOS (Sequoia prior to 15.7.5, Sonoma prior to 14.8.5, Tahoe prior to 26.4)
• Apple tvOS (versions prior to 26.4)
• Apple visionOS (versions prior to 26.4)
• Apple watchOS (versions prior to 26.4)

Discovery Timeline

• 2026-03-25 - CVE-2026-28865 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28865

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization), indicating a flaw in the authorization mechanism that fails to properly validate authentication states. The authentication issue allows an attacker who has achieved a privileged network position—such as through a man-in-the-middle attack on a compromised network—to intercept network traffic that should otherwise be protected by the device's authentication mechanisms.

The flaw affects the core networking stack shared across Apple's operating system family, explaining why iOS, iPadOS, macOS, tvOS, visionOS, and watchOS are all impacted. The improper state management in the authentication process creates a window where network communications can be intercepted before proper authentication is established or validated.

Root Cause

The root cause of CVE-2026-28865 lies in improper state management within the authentication subsystem. Specifically, the authentication mechanism fails to correctly track and validate the authentication state during network communication sessions. This improper handling allows authentication states to become inconsistent, creating opportunities for attackers to bypass authentication checks when positioned on the network path between the victim device and its intended communication endpoint.

Attack Vector

The attack requires the adversary to be in a privileged network position, typically achieved through:

1. Compromising network infrastructure such as routers or access points
2. Executing a man-in-the-middle attack on the same network segment
3. Operating a rogue access point or network proxy

Once positioned, the attacker can exploit the authentication state management flaw to intercept network traffic. This is a network-based attack that does not require user interaction or prior authentication to the target device, though it does require the attacker to have achieved network-level access to the communication path.

The vulnerability allows interception of network communications, which could expose sensitive data including authentication credentials, personal communications, and other private information transmitted by affected devices.

Detection Methods for CVE-2026-28865

Indicators of Compromise

• Unusual network traffic patterns or unexpected connections to unknown endpoints from Apple devices
• Certificate anomalies or warnings during network communications that were previously established without issues
• Unexpected authentication failures or session resets during normal network operations
• Evidence of man-in-the-middle attack infrastructure in network logs or DNS resolution anomalies

Detection Strategies

• Deploy network monitoring solutions to detect anomalous traffic patterns and potential interception attempts targeting Apple devices
• Implement certificate pinning validation monitoring to identify when expected certificates are not being used
• Monitor for signs of ARP spoofing, DNS hijacking, or rogue DHCP server activity on networks with Apple devices
• Enable enhanced logging on network infrastructure to capture authentication handshake anomalies

Monitoring Recommendations

• Enable SentinelOne network traffic analysis to detect suspicious interception patterns targeting managed Apple devices
• Configure alerts for authentication state anomalies and unexpected session behavior across the Apple device fleet
• Monitor network infrastructure logs for evidence of privileged network position attacks
• Implement continuous vulnerability scanning to identify unpatched Apple devices across the enterprise

How to Mitigate CVE-2026-28865

Immediate Actions Required

• Update all Apple devices to the latest patched versions: iOS/iPadOS 18.7.7 or 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4
• Audit network infrastructure for signs of compromise or unauthorized access that could enable privileged network position attacks
• Enable automatic updates on all Apple devices to ensure timely patch deployment
• Review network traffic logs for any signs of historical exploitation or interception attempts

Patch Information

Apple has released security updates addressing this vulnerability across all affected platforms. The following security advisories contain patch information:

• Apple Security Update 126792
• Apple Security Update 126793
• Apple Security Update 126794
• Apple Security Update 126795
• Apple Security Update 126796
• Apple Security Update 126797
• Apple Security Update 126798
• Apple Security Update 126799

Organizations should prioritize deploying these patches to all Apple devices in their environment.

Workarounds

• Use trusted, secured network connections and avoid untrusted public Wi-Fi networks until patches are applied
• Implement network segmentation to limit the potential impact of privileged network position attacks
• Deploy VPN solutions to encrypt traffic and protect against interception on untrusted networks
• Enable additional network-layer security controls such as 802.1X authentication to reduce the risk of unauthorized network access

# Verify iOS/iPadOS version via command line (macOS managed devices)
cfgutil --format CSV get firmwareVersion

# Check macOS version
sw_vers -productVersion

# Force software update check on macOS
softwareupdate --list --all