CVE-2026-28960: Apple iPadOS Denial of Service Vulnerability

CVE-2026-28960 Overview

CVE-2026-28960 is a denial-of-service vulnerability affecting Apple iOS and iPadOS. A remote attacker can trigger the flaw over the network without authentication or user interaction, causing an availability impact on the targeted device. Apple resolved the issue through improved input validation and shipped fixes in iOS 18.7.10 and iPadOS 18.7.10. The vulnerability is categorized under [CWE-20] Improper Input Validation and carries a network-based attack vector with low complexity.

Critical Impact
A remote, unauthenticated attacker can cause a denial-of-service condition on affected iOS and iPadOS devices, disrupting availability without requiring user interaction.

Affected Products

Apple iOS versions prior to 18.7.10
Apple iPadOS versions prior to 18.7.10
Devices supported by the iOS/iPadOS 18.7.x release train

Discovery Timeline

2026-09-14 - CVE-2026-28960 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-28960

Vulnerability Analysis

The flaw is an improper input validation issue [CWE-20] in iOS and iPadOS. According to Apple's advisory, a remote attacker can send crafted input that the affected component fails to validate correctly, leading to a denial-of-service condition. Apple addressed the issue by adding stronger validation of the untrusted input before it reaches the vulnerable code path.

The vulnerability affects confidentiality and integrity minimally but produces a high impact on availability. Exploitation requires no privileges and no user interaction, expanding the pool of potential attackers to anyone who can reach the device across the network.

Root Cause

Apple's advisory attributes the issue to insufficient validation of remotely supplied input. The fix in iOS 18.7.10 and iPadOS 18.7.10 introduces additional validation checks. Apple has not published the affected component or protocol details beyond the general description in the Apple Support Article.

Attack Vector

The attack is network-based and does not require authentication or user interaction. A remote attacker sends malformed data to a network-reachable service on the target device, and the improperly validated input triggers the denial-of-service condition. Because no user prompt is required, opportunistic attackers on the same network or reachable network path can trigger the issue against unpatched devices.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 0.4%.

No verified exploit code is available. Consult the Apple Support Article for the vendor's technical description.

Detection Methods for CVE-2026-28960

Indicators of Compromise

Unexpected device reboots, service crashes, or unresponsive network stacks on iOS or iPadOS 18.7.x devices
Repeated malformed network traffic directed at Apple mobile devices from untrusted sources
Mobile device management (MDM) telemetry showing devices dropping off management repeatedly without user action

Detection Strategies

Monitor MDM and endpoint telemetry for iOS and iPadOS devices reporting OS versions earlier than 18.7.10
Correlate network-layer anomalies with device availability events to identify DoS attempts
Alert on repeated crash reports or reboot cycles from managed Apple mobile devices

Monitoring Recommendations

Deploy network intrusion detection signatures for malformed traffic patterns targeting Apple services once vendor details are published
Track iOS and iPadOS build versions across the fleet through MDM inventory reports
Review firewall and VPN logs for anomalous inbound traffic to mobile device IP ranges

How to Mitigate CVE-2026-28960

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7.10 or iPadOS 18.7.10 as soon as possible
Use MDM policies to enforce the minimum required OS version and block non-compliant devices from sensitive resources
Prioritize patching for devices exposed to untrusted networks such as public Wi-Fi or guest segments

Patch Information

Apple fixed CVE-2026-28960 in iOS 18.7.10 and iPadOS 18.7.10. Administrators should reference the Apple Support Article for the full advisory and deployment guidance. Push the update through Apple's software update mechanism or MDM-managed update policies.

Workarounds

Restrict device exposure to untrusted networks until the patch is applied
Use VPN or network segmentation to limit which hosts can reach mobile devices directly
Disable unused network-facing services on managed devices where policy allows

bash

# Verify iOS/iPadOS version on a managed device via MDM query
# Example: Check installed OS version meets minimum required build
required_version="18.7.10"
current_version=$(mdm_query --device-id "$DEVICE_ID" --field os_version)
if [ "$(printf '%s\n' "$required_version" "$current_version" | sort -V | head -n1)" != "$required_version" ]; then
  echo "Device $DEVICE_ID is out of compliance: $current_version"
fi