CVE-2026-28895: Apple iPadOS Auth Bypass Vulnerability

CVE-2026-28895 Overview

CVE-2026-28895 is a security vulnerability affecting Apple iOS and iPadOS that allows an attacker with physical access to bypass the Stolen Device Protection feature. This improper access control flaw enables unauthorized access to biometrics-gated Protected Apps using only the device passcode, effectively circumventing the intended security mechanism designed to protect sensitive applications.

Critical Impact

Physical attackers can bypass biometric authentication requirements on stolen iOS devices, potentially gaining access to sensitive Protected Apps using only the device passcode.

Affected Products

• Apple iOS versions prior to 26.4
• Apple iPadOS versions prior to 26.4

Discovery Timeline

• March 25, 2026 - CVE-2026-28895 published to NVD
• March 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28895

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within Apple's Stolen Device Protection mechanism. The feature is designed to add an extra layer of security by requiring biometric authentication (Face ID or Touch ID) to access certain protected applications, even when the device passcode is known. However, due to insufficient validation checks, an attacker with physical access to the device can bypass this biometric requirement and access Protected Apps using only the passcode.

The attack requires physical possession of the iOS or iPadOS device, making it a targeted attack vector typically associated with device theft scenarios. While the attack complexity is low and requires no prior privileges or user interaction, the physical access requirement limits the scope of potential exploitation.

Root Cause

The root cause of CVE-2026-28895 is an improper access control condition within the Stolen Device Protection implementation. Apple's security advisory indicates that insufficient checks in the authentication flow allowed the biometric gating mechanism to be circumvented. This represents a failure in the defense-in-depth strategy where the secondary authentication layer did not properly enforce its security requirements.

Attack Vector

The attack vector requires physical access to the target iOS or iPadOS device. An attacker who has obtained both physical possession of the device and knowledge of the passcode (through shoulder surfing, social engineering, or other means) can exploit this vulnerability to:

1. Access Protected Apps that should require biometric authentication
2. Potentially view sensitive data stored within these protected applications
3. Bypass the intended security guarantees of Stolen Device Protection

This vulnerability is particularly concerning in device theft scenarios where criminals may coerce victims into revealing their passcode, as the Stolen Device Protection feature was specifically designed to mitigate such threats.

Detection Methods for CVE-2026-28895

Indicators of Compromise

• Unexpected access to Protected Apps without biometric prompt on devices with Stolen Device Protection enabled
• Anomalous authentication patterns showing passcode-only access to biometrics-gated applications
• Device logs indicating Protected App access without corresponding biometric authentication events

Detection Strategies

• Monitor device management solutions for iOS/iPadOS version compliance across enterprise fleets
• Implement mobile device management (MDM) policies to enforce minimum OS version requirements
• Review authentication logs for Protected App access patterns that bypass biometric requirements

Monitoring Recommendations

• Configure MDM solutions to alert on devices running vulnerable iOS/iPadOS versions
• Monitor for unusual device behavior patterns that may indicate physical compromise
• Implement device attestation checks to verify security feature integrity

How to Mitigate CVE-2026-28895

Immediate Actions Required

• Update all iOS devices to version 26.4 or later immediately
• Update all iPadOS devices to version 26.4 or later immediately
• Review enterprise MDM policies to enforce minimum OS version requirements
• Educate users about the importance of keeping devices updated and protecting passcodes

Patch Information

Apple has addressed this vulnerability in iOS 26.4 and iPadOS 26.4 with improved validation checks. The security update is available through standard iOS/iPadOS update mechanisms. For detailed information, refer to the Apple Security Advisory.

Organizations should prioritize deployment of this update across all managed iOS and iPadOS devices, particularly those containing sensitive corporate data or applications.

Workarounds

• Limit physical access to devices containing sensitive information until patches can be applied
• Consider temporarily disabling access to highly sensitive applications on unpatched devices
• Implement additional authentication requirements at the application layer where possible
• Monitor for device theft incidents and remotely wipe compromised devices promptly

# MDM Configuration - Enforce minimum iOS/iPadOS version
# Example: Apple Configurator or MDM profile enforcement
# Set minimum OS version requirement to 26.4
# Restrict access to corporate resources from non-compliant devices