CVE-2026-65329: Apple iPadOS IPSec Authentication Bypass

CVE-2026-65329 Overview

CVE-2026-65329 is an authentication bypass vulnerability affecting Apple iOS and iPadOS. The flaw resides in the IPSec implementation and allows an attacker in a privileged network position to bypass authentication and intercept network traffic. Apple addressed the issue through improved state management in iOS 26.6.1 and iPadOS 26.6.1. The vulnerability is classified under [CWE-287] Improper Authentication and requires adjacent network access to exploit.

Critical Impact
A network-adjacent attacker can bypass IPSec authentication and intercept encrypted VPN traffic, exposing confidential data traversing supposedly secure tunnels.

Affected Products

Apple iOS versions prior to 26.6.1
Apple iPadOS versions prior to 26.6.1
Devices using IPSec-based VPN configurations

Discovery Timeline

2026-08-17 - CVE-2026-65329 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-65329

Vulnerability Analysis

The vulnerability affects the IPSec authentication routine in iOS and iPadOS. IPSec relies on state tracking to validate that peers have completed the required authentication handshake before permitting encrypted traffic. Improper state management in the affected versions allows an attacker positioned on the same network segment to manipulate the authentication state machine. This manipulation enables the attacker to bypass the authentication check that normally protects the IPSec tunnel.

Once authentication is bypassed, the attacker can intercept traffic that clients believe is protected by IPSec. This defeats the confidentiality guarantees of the VPN and exposes traffic on untrusted networks such as public Wi-Fi.

Root Cause

The root cause is improper state management within Apple's IPSec authentication logic. The affected code did not correctly enforce transitions between authentication states, permitting a peer to reach an authenticated state without satisfying the required cryptographic proof. Apple's fix rewrites the state handling to enforce stricter validation of authentication progress before granting tunnel access.

Attack Vector

Exploitation requires the attacker to hold a privileged position on the network adjacent to the victim, such as a rogue access point or a compromised router. The attacker interacts with the IPSec negotiation to place the victim's device into a state where authentication is treated as complete. After bypass, the attacker relays or observes traffic between the endpoint and the intended VPN concentrator. See the Apple Support Article for vendor-provided technical context.

No verified proof-of-concept code is publicly available for CVE-2026-65329.
Refer to the Apple security advisory for authoritative technical details.

Detection Methods for CVE-2026-65329

Indicators of Compromise

Unexpected IPSec session establishment logs on VPN concentrators from mobile clients on untrusted networks
IKE/ISAKMP negotiation anomalies where authentication phases complete out of expected order
Duplicate or spoofed Security Parameter Index (SPI) values observed in IPSec traffic

Detection Strategies

Monitor VPN gateway logs for IPSec Phase 1 and Phase 2 completions that skip expected authentication messages
Compare device-reported VPN status against gateway-side session records to identify inconsistencies
Inspect network telemetry for IPSec traffic terminating at unauthorized endpoints on adjacent networks

Monitoring Recommendations

Enable verbose IKE logging on VPN concentrators and forward events to a centralized analytics platform
Alert on IPSec associations established from iOS or iPadOS devices running versions earlier than 26.6.1
Track mobile device OS versions through mobile device management (MDM) inventory to identify unpatched endpoints

How to Mitigate CVE-2026-65329

Immediate Actions Required

Update all iPhone and iPad devices to iOS 26.6.1 or iPadOS 26.6.1 immediately
Audit MDM inventory to identify devices still running vulnerable OS versions and force updates
Restrict corporate VPN access from mobile devices until patched, especially over untrusted networks

Patch Information

Apple released fixes in iOS 26.6.1 and iPadOS 26.6.1. The patch resolves the issue through improved state management in the IPSec authentication implementation. Full advisory details are available in the Apple Support Article.

Workarounds

Avoid connecting IPSec VPNs from untrusted networks such as public Wi-Fi until patching is complete
Require certificate-based authentication with strict validation on VPN concentrators to raise the exploitation bar
Enforce always-on cellular connectivity for high-risk users to bypass hostile Wi-Fi environments

bash

# Verify iOS/iPadOS version on managed devices via MDM query
# Example: check that OSVersion is >= 26.6.1
mdm query --attribute OSVersion --filter "OSVersion < 26.6.1"