CVE-2026-28965: Apple iPadOS Information Disclosure Flaw

CVE-2026-28965 Overview

CVE-2026-28965 is a privacy vulnerability affecting Apple iOS and iPadOS that allows a user to view restricted content directly from the lock screen. Apple addressed the issue with improved checks in iOS 26.5 and iPadOS 26.5. The flaw is categorized under [CWE-284] (Improper Access Control) and stems from insufficient enforcement of access restrictions on content rendered while the device is locked.

The vulnerability does not require authentication or user interaction beyond interacting with the lock screen. Apple published the corresponding advisory on its support portal, listing the issue among the security content fixed in the 26.5 release cycle.

Critical Impact
An attacker with physical access to a locked device can view content that should remain hidden behind the lock screen, exposing confidential user data.

Affected Products

Apple iOS versions prior to 26.5
Apple iPadOS versions prior to 26.5
Devices configured to display restricted content notifications on the lock screen

Discovery Timeline

2026-05-11 - CVE-2026-28965 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28965

Vulnerability Analysis

The vulnerability is an improper access control issue [CWE-284] affecting the lock screen content rendering logic in iOS and iPadOS. The lock screen is designed to gate access to user data when the device is in a locked state. The flaw allows a user to bypass this gate and view restricted content without unlocking the device.

Apple's advisory describes the resolution as a privacy issue addressed with improved checks. This phrasing indicates the affected code path failed to consistently verify the device lock state or the sensitivity classification of content before display. The fix introduces additional validation to ensure restricted content is suppressed when the device is locked.

The affected attack surface is narrow but high-impact. Exposed content may include notifications, message previews, widget data, or other application content marked as private.

Root Cause

The root cause is a missing or insufficient check within the lock screen presentation pipeline. The code did not enforce the user-configured or system-enforced restriction policy under all conditions, permitting protected content to render on the lock screen surface.

Attack Vector

The NVD classifies the attack vector as Network, though the practical exploitation scenario requires interaction with the lock screen of a vulnerable device. An attacker with brief physical proximity to an unattended device can observe restricted content without entering a passcode, Face ID, or Touch ID credential. No specialized tooling or exploitation framework is required.

No public proof-of-concept code or exploit has been published for this issue. Refer to the Apple Support Article for the authoritative description.

Detection Methods for CVE-2026-28965

Indicators of Compromise

No file-based or network-based indicators are published for this vulnerability
Unexpected display of message previews, notifications, or widget content on locked devices running iOS or iPadOS below 26.5
User reports of restricted application content visible without authentication

Detection Strategies

Inventory managed iOS and iPadOS devices using Mobile Device Management (MDM) and flag any running versions earlier than 26.5
Audit lock screen privacy settings centrally through MDM configuration profiles
Correlate device OS versions against the patched baseline within asset management systems

Monitoring Recommendations

Enable MDM compliance policies that alert when enrolled devices fall behind the current supported iOS or iPadOS release
Track Apple security advisory feeds and ingest them into vulnerability management workflows
Monitor help desk tickets referencing unexpected lock screen content as a potential exposure signal

How to Mitigate CVE-2026-28965

Immediate Actions Required

Update all affected iPhones to iOS 26.5 and iPads to iPadOS 26.5
Push the update through MDM with a mandatory deadline for managed fleets
Re-verify lock screen privacy settings after the update is installed

Patch Information

Apple released fixes for CVE-2026-28965 in iOS 26.5 and iPadOS 26.5. The patch introduces improved access checks within the lock screen content rendering path. Full details are available in the Apple Support Article.

Workarounds

Disable lock screen notification previews under Settings > Notifications > Show Previews and set the value to When Unlocked
Restrict widget visibility on the lock screen until devices are patched
Enforce a strong passcode and reduce the Auto-Lock interval to minimize exposure windows

bash

# MDM compliance check example - verify device OS version meets the patched baseline
# Reject enrollment or quarantine devices below iOS/iPadOS 26.5
MINIMUM_IOS_VERSION="26.5"
MINIMUM_IPADOS_VERSION="26.5"