CVE-2026-28870: Apple iPadOS Information Disclosure Flaw

CVE-2026-28870 Overview

CVE-2026-28870 is an information leakage vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The vulnerability stems from insufficient validation that could allow a malicious application to access sensitive user data without proper authorization.

This vulnerability represents a significant privacy concern across Apple's ecosystem, as it affects devices ranging from iPhones and iPads to Macs, Apple TVs, Apple Watch, and Vision Pro headsets. An attacker with the ability to install or run a malicious application on an affected device could potentially exfiltrate private user information.

Critical Impact

A malicious app running on affected Apple devices may bypass security controls to access sensitive user data, potentially compromising user privacy across the entire Apple ecosystem.

Affected Products

• Apple iOS versions prior to 26.4
• Apple iPadOS versions prior to 26.4
• Apple macOS Tahoe versions prior to 26.4
• Apple tvOS versions prior to 26.4
• Apple visionOS versions prior to 26.4
• Apple watchOS versions prior to 26.4

Discovery Timeline

• 2026-03-25 - CVE-2026-28870 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-28870

Vulnerability Analysis

CVE-2026-28870 is classified as an information leakage vulnerability that was addressed through additional validation mechanisms. The flaw exists in a system component shared across Apple's operating systems, allowing applications to potentially circumvent data access restrictions.

The vulnerability requires local access to exploit, meaning an attacker would need to deploy a malicious application on the target device. Once running, the application could access sensitive user data that should be protected by the operating system's security boundaries. The confidentiality impact is high, though the vulnerability does not enable modification of data or cause system availability issues.

This type of information disclosure vulnerability is particularly concerning in mobile and wearable environments where devices often contain highly personal data including health information, location history, contacts, and private communications.

Root Cause

The root cause of CVE-2026-28870 involves insufficient validation when applications request access to certain system resources or data stores. Apple's description indicates that additional validation checks were implemented to remediate the issue, suggesting that the original code path lacked adequate verification of application entitlements or permissions before granting access to protected data.

Information leakage vulnerabilities of this nature typically occur when security boundaries between applications and system services are not properly enforced, allowing data to flow to unauthorized recipients.

Attack Vector

The attack vector for CVE-2026-28870 is local, requiring the attacker to have the ability to execute code on the target device. In practice, this could be achieved through:

• Distribution of a malicious application through unofficial channels or sideloading
• Compromise of an existing legitimate application
• Social engineering to convince users to install malicious software
• Exploitation in conjunction with other vulnerabilities to gain initial code execution

Once the malicious application is running on the device, it can leverage the information leakage flaw to read sensitive user data that should be protected by operating system security mechanisms.

The attack does not require user interaction beyond the initial installation, and an attacker with low privileges can exploit this vulnerability to access high-value confidential information.

Detection Methods for CVE-2026-28870

Indicators of Compromise

• Unusual application behavior involving excessive data access requests or API calls to sensitive data stores
• Applications accessing data outside their expected scope or entitlements
• Unexpected network traffic from applications that may indicate data exfiltration
• System logs showing permission-related warnings or access attempts to protected resources

Detection Strategies

• Monitor application entitlement usage and flag applications requesting or accessing sensitive data unexpectedly
• Implement endpoint detection solutions capable of identifying suspicious application behavior on Apple devices
• Review installed applications for unsigned or sideloaded software that could be malicious
• Deploy mobile threat defense (MTD) solutions to detect potentially harmful applications

Monitoring Recommendations

• Enable and review system logs on macOS devices for unusual data access patterns
• Utilize Mobile Device Management (MDM) solutions to maintain visibility into installed applications
• Monitor for applications that have not been updated and may be leveraging this vulnerability
• Implement network monitoring to detect potential data exfiltration from managed devices

How to Mitigate CVE-2026-28870

Immediate Actions Required

• Update all Apple devices to the latest operating system versions immediately (iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4)
• Review installed applications and remove any untrusted or suspicious software
• Restrict application installation to the official App Store where possible
• Audit device configurations to ensure security controls are properly enabled

Patch Information

Apple has released security updates addressing CVE-2026-28870 across all affected platforms. The patches implement additional validation to prevent unauthorized access to sensitive user data. Organizations and individuals should apply the following updates:

• iOS 26.4 and iPadOS 26.4 - See Apple Support Advisory #126792
• macOS Tahoe 26.4 - See Apple Support Advisory #126794
• tvOS 26.4 - See Apple Support Advisory #126797
• visionOS 26.4 - See Apple Support Advisory #126798
• watchOS 26.4 - See Apple Support Advisory #126799

Workarounds

• Restrict installation of applications to only those from trusted sources and the official App Store
• Implement Mobile Device Management (MDM) policies to limit application permissions and enforce security configurations
• Disable sideloading capabilities on iOS/iPadOS devices where enterprise distribution is not required
• Regularly audit installed applications and remove those that are no longer needed or maintained

# Check current iOS/iPadOS version via command line (for supervised devices)
# Administrators can verify device versions through MDM console
# Ensure all managed devices report version 26.4 or later

# For macOS, check system version:
sw_vers -productVersion
# Should return 26.4 or later for macOS Tahoe