CVE-2026-28974: Apple iPadOS Denial-of-Service Vulnerability

CVE-2026-28974 Overview

CVE-2026-28974 is a denial-of-service vulnerability affecting multiple Apple operating systems. The flaw stems from insufficient authorization checks that allow a malicious application to trigger a denial-of-service condition. Apple addressed the issue with improved checks to prevent unauthorized actions. The vulnerability is categorized under [CWE-284] Improper Access Control. The issue is fixed in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Affected users span Apple's entire device ecosystem, including iPhone, iPad, Mac, Apple TV, Apple Vision Pro, and Apple Watch.

Critical Impact
A malicious application can cause a denial-of-service condition affecting device availability across Apple's iOS, iPadOS, macOS, tvOS, visionOS, and watchOS platforms.

Affected Products

Apple iOS and iPadOS versions prior to 26.5
Apple macOS Sequoia prior to 15.7.7 and macOS Tahoe prior to 26.5
Apple tvOS, visionOS, and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-28974 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-28974

Vulnerability Analysis

The vulnerability allows an application running on an affected Apple device to invoke functionality without proper authorization validation. Because the affected component fails to confirm the caller's permissions before executing a privileged action, a malicious app can drive the system into a state that disrupts normal operation. The result is a denial-of-service condition that impairs device availability.

Apple classifies this under improper access control [CWE-284]. The fix introduces stricter authorization checks to ensure that only callers with the appropriate entitlements can invoke the affected code path. The advisory does not describe code execution, data disclosure, or integrity impact, only availability loss.

Root Cause

The root cause is missing or insufficient authorization checks on a system interface exposed to applications. Without these checks, an app can perform an action it should not be permitted to execute, leading to resource exhaustion or a service crash that manifests as denial-of-service.

Attack Vector

Exploitation requires a malicious or compromised app to run on the target device. The app does not need elevated privileges or user interaction beyond installation. While the NVD vector lists a network attack vector, Apple's advisory frames the threat model around a local app abusing the interface. Refer to Apple Support Article #127110 for vendor-supplied technical context.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-28974

Indicators of Compromise

Unexpected application crashes, system service restarts, or device reboots originating from a recently installed or updated third-party app.
Repeated process termination events or watchdog-triggered restarts logged on Apple endpoints.
Apps making anomalous calls to system services followed by service unavailability.

Detection Strategies

Inventory Apple endpoints and identify devices running OS versions prior to the fixed releases listed in the Apple advisories.
Monitor mobile device management (MDM) telemetry for crash reports and abnormal reboot patterns correlated with specific apps.
Review installed application provenance and flag sideloaded or unsigned apps that exhibit unusual system API usage.

Monitoring Recommendations

Enroll Apple devices in MDM to receive OS version compliance reports and enforce minimum patched versions.
Aggregate device crash logs into a centralized logging or SIEM platform for anomaly review.
Track Apple security advisories (127110, 127115, 127116, 127118, 127119, 127120) for updates to affected components.

How to Mitigate CVE-2026-28974

Immediate Actions Required

Update all Apple devices to iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, or watchOS 26.5.
Enforce minimum OS version policies through MDM to block out-of-date devices from accessing corporate resources.
Audit installed applications and remove untrusted or unnecessary third-party apps.

Patch Information

Apple released patches across its product line addressing CVE-2026-28974. Fixed versions are iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. Consult the relevant Apple Support article for each platform: iOS/iPadOS, macOS Sequoia, macOS Tahoe, tvOS, visionOS, and watchOS.

Workarounds

Restrict app installations to vetted sources such as the Apple App Store and managed enterprise app catalogs.
Use MDM configuration profiles to limit installation of unmanaged apps on corporate devices.
Educate users to avoid sideloading apps or installing developer-signed builds from untrusted publishers.

bash

# Verify current OS version on macOS
sw_vers

# Trigger software update check on macOS
sudo softwareupdate -l
sudo softwareupdate -i -a -R

# On iOS/iPadOS: Settings > General > Software Update
# Confirm version is 26.5 or later (15.7.7 for macOS Sequoia)