CVE-2026-28874: Apple iPadOS DOS Vulnerability

CVE-2026-28874 Overview

CVE-2026-28874 is a Denial of Service vulnerability affecting Apple iOS and iPadOS that allows remote attackers to cause unexpected application termination. The vulnerability stems from improper resource consumption controls (CWE-400), which can be exploited over the network without requiring any authentication or user interaction.

Critical Impact

Remote attackers can exploit this vulnerability to terminate applications unexpectedly on affected Apple devices, potentially disrupting critical services and user workflows without requiring any privileges or user interaction.

Affected Products

• Apple iOS versions prior to 26.4
• Apple iPadOS versions prior to 26.4

Discovery Timeline

• March 25, 2026 - CVE-2026-28874 published to NVD
• March 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28874

Vulnerability Analysis

This vulnerability is classified as a Resource Exhaustion issue (CWE-400: Uncontrolled Resource Consumption). The flaw exists within Apple's iOS and iPadOS operating systems and can be exploited remotely over the network. The attack requires no authentication and no user interaction, making it particularly concerning for enterprise deployments where device availability is critical.

The vulnerability allows attackers to trigger unexpected application termination by sending specially crafted requests that cause the system to improperly handle resource consumption. Apple addressed this issue by implementing improved validation checks within the affected components.

Root Cause

The root cause of CVE-2026-28874 is insufficient input validation and resource consumption controls within the iOS and iPadOS operating systems. The affected code path failed to properly limit or manage resources when processing certain types of network requests, allowing an attacker to exhaust system resources and cause application crashes.

Attack Vector

The attack vector for this vulnerability is network-based, meaning an attacker can exploit it remotely without needing local access to the device. The exploitation characteristics include:

• Remote Exploitation: Attackers can target devices over the network
• No Authentication Required: The vulnerability can be exploited without valid credentials
• No User Interaction: Victims do not need to click links or perform actions
• Availability Impact: Successful exploitation results in application termination (denial of service)

The vulnerability manifests through improper resource consumption handling. When a remote attacker sends malicious requests designed to trigger excessive resource allocation, the affected application fails to properly limit consumption, ultimately leading to an unexpected termination. Detailed technical information is available in the Apple Support Document.

Detection Methods for CVE-2026-28874

Indicators of Compromise

• Unexpected and repeated application crashes or terminations on iOS/iPadOS devices
• Unusual network traffic patterns or connections from unknown sources targeting Apple devices
• System logs showing resource exhaustion errors or application termination events
• Users reporting frequent app crashes without apparent cause

Detection Strategies

• Monitor device management consoles for unusual application crash patterns across managed iOS/iPadOS devices
• Implement network intrusion detection rules to identify potentially malicious traffic targeting Apple devices
• Review device logs for CWE-400 related symptoms including memory exhaustion or excessive CPU usage
• Deploy endpoint detection solutions capable of identifying resource exhaustion attack patterns

Monitoring Recommendations

• Enable detailed logging on mobile device management (MDM) platforms to track application stability
• Configure alerts for repeated application termination events within short time periods
• Monitor network traffic at perimeter devices for anomalous patterns targeting iOS/iPadOS endpoints
• Implement SentinelOne Mobile Threat Defense for real-time detection of exploitation attempts

How to Mitigate CVE-2026-28874

Immediate Actions Required

• Update all affected devices to iOS 26.4 and iPadOS 26.4 immediately
• Use Mobile Device Management (MDM) solutions to enforce mandatory updates across enterprise fleets
• Monitor for devices that have not been updated and prioritize their remediation
• Review network logs for any signs of exploitation attempts prior to patching

Patch Information

Apple has released security updates that address this vulnerability by implementing improved checks within the affected components. The fixes are included in:

• iOS 26.4 - Contains the security patch for CVE-2026-28874
• iPadOS 26.4 - Contains the security patch for CVE-2026-28874

Organizations should reference the Apple Support Document for detailed update instructions and release notes.

Workarounds

• Restrict network access to potentially affected devices until patches can be applied
• Implement network segmentation to limit exposure of unpatched iOS/iPadOS devices
• Configure firewall rules to filter suspicious traffic patterns targeting mobile endpoints
• Consider temporarily disabling network-facing features on critical devices if patching is delayed

# MDM Configuration - Enforce minimum OS version requirement
# Example configuration profile setting for iOS/iPadOS minimum version
# Apply via your MDM solution (Jamf, Intune, etc.)
# Minimum OS Version: 26.4
# Restrict enrollment and access for devices below this version