CVE-2026-28938: Apple iPadOS Information Disclosure Flaw

CVE-2026-28938 Overview

CVE-2026-28938 is a privacy vulnerability in Apple iOS and iPadOS that allows an installed application to fingerprint the user. The flaw stems from sensitive data being accessible in a location that permitted unauthorized apps to correlate device or user attributes. Apple addressed the issue by moving the sensitive data out of reach of the affected code paths. The vulnerability is fixed in iOS 26.6 and iPadOS 26.6. The weakness is classified under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
An app installed on an affected device may harvest identifiers that enable persistent user fingerprinting across sessions and applications, undermining platform privacy guarantees.

Affected Products

Apple iOS versions prior to 26.6
Apple iPadOS versions prior to 26.6
Applications leveraging the affected system data surfaces on unpatched devices

Discovery Timeline

2026-09-14 - CVE-2026-28938 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-28938

Vulnerability Analysis

The vulnerability exposes sensitive data in a system-accessible location on iOS and iPadOS. An application installed on the device can read this data and construct a stable fingerprint of the user or device. Apple's advisory describes the remediation as relocating the sensitive data, indicating the underlying data structure or attribute was reachable from an unprivileged app context. Fingerprinting circumvents Apple's per-app privacy boundaries and permits cross-app or cross-session user tracking without requiring user consent.

Root Cause

The root cause is improper placement of sensitive attributes within a data surface readable by third-party applications. Because the values are stable identifiers or derivable into stable identifiers, they enable unauthorized correlation. This maps to [CWE-359], the exposure of private personal information to an unauthorized actor.

Attack Vector

Exploitation requires an application running on the target device. The app queries the affected system data, extracts the exposed values, and transmits them to an attacker-controlled service. No user interaction beyond installing the app is required, and no elevated privileges are needed. Refer to the Apple Support Article for advisory-level technical detail.

No verified proof-of-concept code is publicly available for CVE-2026-28938.
Apple's advisory documents the fix without disclosing the affected data surface.

Detection Methods for CVE-2026-28938

Indicators of Compromise

Installed applications making repeated reads of system metadata APIs shortly after launch
Outbound network traffic from apps containing stable identifiers correlated across devices or users
App Store or enterprise-distributed applications requesting data unrelated to their stated functionality

Detection Strategies

Audit installed applications on devices running iOS or iPadOS earlier than 26.6 for privacy-sensitive API usage
Review App Privacy Reports on managed devices to identify apps performing unexpected data collection
Monitor mobile device management (MDM) telemetry for devices that have not yet updated to the patched build

Monitoring Recommendations

Enforce MDM compliance rules requiring iOS 26.6 or iPadOS 26.6 as the minimum operating system version
Track application behaviors that correlate with fingerprinting patterns, such as bulk metadata queries at launch
Log and alert on outbound traffic from mobile apps to unfamiliar analytics or tracking endpoints

How to Mitigate CVE-2026-28938

Immediate Actions Required

Update all iPhone devices to iOS 26.6 and all iPad devices to iPadOS 26.6
Push the update through MDM to accelerate rollout across managed fleets
Review installed applications and remove untrusted apps that request extensive device metadata

Patch Information

Apple resolved CVE-2026-28938 in iOS 26.6 and iPadOS 26.6 by relocating the sensitive data so it is no longer reachable by third-party applications. Detailed advisory information is available in the Apple Support Article.

Workarounds

No official workaround exists; installing the vendor patch is the only supported remediation
Limit installation of third-party applications on devices that cannot be updated immediately
Restrict enterprise app distribution to vetted publishers until fleet-wide patching is complete

bash

# Verify iOS/iPadOS version on a managed device via MDM query
# Example: confirm the device reports build 26.6 or later
OSVersion >= 26.6