CVE-2026-28963: Apple iPadOS Information Disclosure Flaw

CVE-2026-28963 Overview

CVE-2026-28963 is a privacy vulnerability affecting Apple iOS and iPadOS prior to version 26.5. The flaw allows an attacker with physical access to a device to leverage Visual Intelligence to access sensitive user data during an active iPhone Mirroring session. Apple addressed the issue by removing the vulnerable code in iOS 26.5 and iPadOS 26.5. The weakness is classified under [CWE-359] (Exposure of Private Personal Information to an Unauthorized Actor).

Critical Impact
An attacker with physical access to an unlocked device can use Visual Intelligence to read sensitive user data exposed through iPhone Mirroring, leading to confidentiality loss.

Affected Products

Apple iOS versions prior to 26.5
Apple iPadOS versions prior to 26.5
Devices supporting iPhone Mirroring with Visual Intelligence enabled

Discovery Timeline

2026-05-11 - CVE-2026-28963 published to the National Vulnerability Database (NVD)
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28963

Vulnerability Analysis

The vulnerability resides in the interaction between Visual Intelligence and the iPhone Mirroring feature on iOS and iPadOS. iPhone Mirroring streams the contents of an iPhone display to a connected Mac, including sensitive notifications, messages, and application content. Visual Intelligence is designed to analyze on-screen imagery and surface contextual information.

When Visual Intelligence operates against a mirrored iPhone session, it can parse and expose user data that should remain protected behind device authentication. The attacker must hold physical access to the device participating in the mirroring session. No user interaction beyond the existing mirroring context is required, and no special privileges are needed on the target.

Apple categorized the defect under [CWE-359], indicating an information disclosure class issue rather than memory corruption or code execution. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.02%, reflecting limited real-world exploitation likelihood given the physical access requirement.

Root Cause

The root cause is improper scoping of Visual Intelligence's data access boundary during iPhone Mirroring sessions. The feature was permitted to operate on screen content that included private user data without enforcing the privacy controls that normally gate such information. Apple's remediation removed the vulnerable code path entirely rather than adding additional access checks.

Attack Vector

Exploitation requires physical proximity to a device with an active iPhone Mirroring session. An attacker invokes Visual Intelligence against the mirrored display and extracts sensitive content such as message contents, account identifiers, or other private application data rendered on screen. No remote network path exists. Refer to the Apple Support Article for vendor-supplied technical details.

Detection Methods for CVE-2026-28963

Indicators of Compromise

Unexpected iPhone Mirroring sessions initiated on managed Mac endpoints
Visual Intelligence usage events recorded on devices running iOS or iPadOS earlier than 26.5
Unattended devices with active mirroring sessions left in shared or public spaces

Detection Strategies

Inventory managed Apple devices and identify versions of iOS and iPadOS below 26.5 using mobile device management (MDM) reporting
Audit Continuity and iPhone Mirroring configuration profiles across the fleet
Correlate device unlock events with mirroring session initiation to spot unauthorized physical access

Monitoring Recommendations

Forward MDM compliance telemetry and device posture events to a centralized analytics platform for version drift tracking
Alert on devices that remain on iOS or iPadOS releases prior to 26.5 after the patch window closes
Review physical security controls for shared workstations where iPhone Mirroring is permitted

How to Mitigate CVE-2026-28963

Immediate Actions Required

Update all iPhone devices to iOS 26.5 and all iPad devices to iPadOS 26.5
Enforce the minimum OS version through MDM compliance policies and block non-compliant devices from corporate resources
Require device passcodes and short auto-lock timers to reduce the window of physical access exposure

Patch Information

Apple resolved CVE-2026-28963 in iOS 26.5 and iPadOS 26.5 by removing the vulnerable code path that allowed Visual Intelligence to access sensitive user data during iPhone Mirroring. Administrators should consult the Apple Support Article for the full advisory and deploy the update through MDM or user-initiated software updates.

Workarounds

Disable iPhone Mirroring on macOS until all paired iPhones are updated to iOS 26.5
Restrict the use of Visual Intelligence on devices that have not yet received the patch
Maintain strict physical control of unlocked iPhones, particularly in shared workspaces

bash

# Verify iOS version on a managed device via MDM query or Settings
# Settings > General > About > Software Version
# Target: iOS 26.5 or later, iPadOS 26.5 or later