CVE-2026-28967: Apple iPadOS DOS Vulnerability

CVE-2026-28967 Overview

CVE-2026-28967 is a denial-of-service vulnerability affecting Apple iOS and iPadOS. The flaw stems from improper input validation that an attacker in a privileged network position can abuse to disrupt service availability on affected devices. Apple addressed the issue through improved input validation in iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, and iPadOS 26.4. The weakness is categorized under [CWE-400] (Uncontrolled Resource Consumption). Exploitation requires high privileges and network adjacency, which limits the attack surface but does not eliminate operational risk for users on untrusted networks.

Critical Impact
A network-adjacent attacker with elevated privileges can trigger a denial-of-service condition on unpatched iOS and iPadOS devices, disrupting device availability.

Affected Products

Apple iOS versions prior to 18.7.7 and prior to 26.4
Apple iPadOS versions prior to 18.7.7 and prior to 26.4
Apple iPhone and iPad devices running the affected operating system builds

Discovery Timeline

2026-05-11 - CVE-2026-28967 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28967

Vulnerability Analysis

The vulnerability resides in input handling logic within iOS and iPadOS network-facing components. Insufficient validation of attacker-controlled input allows uncontrolled resource consumption, resulting in a denial-of-service condition. The issue maps to [CWE-400] and impacts only availability, not confidentiality or integrity. Apple's advisories (Apple Security Advisory 126792 and Apple Security Advisory 126793) confirm that improved input validation resolves the defect. The EPSS probability is 0.054%, indicating a low likelihood of near-term exploitation in the wild.

Root Cause

The root cause is missing or insufficient validation of structured input received over the network. When the affected component processes malformed or unexpected input, it consumes resources without bounds, leading to service disruption. Apple's fix tightens validation checks so that malformed input is rejected before triggering resource exhaustion.

Attack Vector

Exploitation requires the attacker to occupy a privileged position on the network path between the victim device and a remote endpoint. From that vantage point, the attacker can deliver crafted input that the target processes. No user interaction is required. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Apple advisories for technical context on the affected components.

Detection Methods for CVE-2026-28967

Indicators of Compromise

Unexpected device unresponsiveness, service crashes, or reboots on iOS or iPadOS devices following network activity on untrusted segments
Abnormal traffic patterns originating from network positions capable of intercepting or modifying traffic to Apple devices
Repeated failed connections or malformed protocol exchanges captured at network egress points

Detection Strategies

Inventory iOS and iPadOS device versions and flag any build below 18.7.7 or 26.4 as exposed
Monitor mobile device management (MDM) telemetry for crash reports and abnormal reboot frequencies on Apple mobile devices
Inspect network traffic to mobile devices for malformed protocol payloads consistent with input-validation abuse

Monitoring Recommendations

Continuously track Apple OS version compliance through MDM platforms and alert on devices that fall behind patch baselines
Aggregate device health and crash telemetry into a centralized analytics platform for correlation across the fleet
Monitor Wi-Fi infrastructure for rogue access points and man-in-the-middle conditions that could enable privileged network positioning

How to Mitigate CVE-2026-28967

Immediate Actions Required

Update all iPhone and iPad devices to iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, or iPadOS 26.4 or later
Use MDM policies to enforce the minimum patched OS version across managed devices
Restrict use of untrusted public Wi-Fi networks for devices that cannot be updated immediately

Patch Information

Apple released fixes in iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, and iPadOS 26.4. Patch details are published in Apple Security Advisory 126792 and Apple Security Advisory 126793. Administrators should validate device compliance after deploying the updates.

Workarounds

Require corporate VPN usage on mobile devices to reduce exposure to attackers in privileged network positions
Disable automatic connection to open or unverified Wi-Fi networks through MDM configuration profiles
Apply network segmentation and certificate pinning where supported to limit man-in-the-middle exposure

bash

# Example MDM compliance query to identify unpatched iOS/iPadOS devices
# Replace with your MDM platform's syntax
mdm-cli devices list \
  --platform ios,ipados \
  --os-version-less-than 18.7.7 \
  --output compliance-report.csv