CVE-2026-28895: Apple iPadOS Auth Bypass Vulnerability

CVE-2026-28895 Overview

CVE-2026-28895 is a security vulnerability affecting Apple iOS and iPadOS that allows an attacker with physical access to bypass the Stolen Device Protection feature. This improper access control flaw enables unauthorized access to biometrics-gated Protected Apps using only the device passcode, effectively circumventing the intended security mechanism designed to protect sensitive applications.

Critical Impact
Physical attackers can bypass biometric authentication requirements on stolen iOS devices, potentially gaining access to sensitive Protected Apps using only the device passcode.

Affected Products

Apple iOS versions prior to 26.4
Apple iPadOS versions prior to 26.4

Discovery Timeline

March 25, 2026 - CVE-2026-28895 published to NVD
March 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28895

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within Apple's Stolen Device Protection mechanism. The feature is designed to add an extra layer of security by requiring biometric authentication (Face ID or Touch ID) to access certain protected applications, even when the device passcode is known. However, due to insufficient validation checks, an attacker with physical access to the device can bypass this biometric requirement and access Protected Apps using only the passcode.

The attack requires physical possession of the iOS or iPadOS device, making it a targeted attack vector typically associated with device theft scenarios. While the attack complexity is low and requires no prior privileges or user interaction, the physical access requirement limits the scope of potential exploitation.

Root Cause

The root cause of CVE-2026-28895 is an improper access control condition within the Stolen Device Protection implementation. Apple's security advisory indicates that insufficient checks in the authentication flow allowed the biometric gating mechanism to be circumvented. This represents a failure in the defense-in-depth strategy where the secondary authentication layer did not properly enforce its security requirements.

Attack Vector

The attack vector requires physical access to the target iOS or iPadOS device. An attacker who has obtained both physical possession of the device and knowledge of the passcode (through shoulder surfing, social engineering, or other means) can exploit this vulnerability to:

Access Protected Apps that should require biometric authentication
Potentially view sensitive data stored within these protected applications
Bypass the intended security guarantees of Stolen Device Protection

This vulnerability is particularly concerning in device theft scenarios where criminals may coerce victims into revealing their passcode, as the Stolen Device Protection feature was specifically designed to mitigate such threats.

Detection Methods for CVE-2026-28895

Indicators of Compromise

Unexpected access to Protected Apps without biometric prompt on devices with Stolen Device Protection enabled
Anomalous authentication patterns showing passcode-only access to biometrics-gated applications
Device logs indicating Protected App access without corresponding biometric authentication events

Detection Strategies

Monitor device management solutions for iOS/iPadOS version compliance across enterprise fleets
Implement mobile device management (MDM) policies to enforce minimum OS version requirements
Review authentication logs for Protected App access patterns that bypass biometric requirements

Monitoring Recommendations

Configure MDM solutions to alert on devices running vulnerable iOS/iPadOS versions
Monitor for unusual device behavior patterns that may indicate physical compromise
Implement device attestation checks to verify security feature integrity

How to Mitigate CVE-2026-28895

Immediate Actions Required

Update all iOS devices to version 26.4 or later immediately
Update all iPadOS devices to version 26.4 or later immediately
Review enterprise MDM policies to enforce minimum OS version requirements
Educate users about the importance of keeping devices updated and protecting passcodes

Patch Information

Apple has addressed this vulnerability in iOS 26.4 and iPadOS 26.4 with improved validation checks. The security update is available through standard iOS/iPadOS update mechanisms. For detailed information, refer to the Apple Security Advisory.

Organizations should prioritize deployment of this update across all managed iOS and iPadOS devices, particularly those containing sensitive corporate data or applications.

Workarounds

Limit physical access to devices containing sensitive information until patches can be applied
Consider temporarily disabling access to highly sensitive applications on unpatched devices
Implement additional authentication requirements at the application layer where possible
Monitor for device theft incidents and remotely wipe compromised devices promptly

bash

# MDM Configuration - Enforce minimum iOS/iPadOS version
# Example: Apple Configurator or MDM profile enforcement
# Set minimum OS version requirement to 26.4
# Restrict access to corporate resources from non-compliant devices