CVE-2026-86890: Apple iPadOS Information Disclosure Flaw

CVE-2026-86890 Overview

CVE-2026-86890 is a logic flaw in Apple iOS and iPadOS that allows an attacker with physical access to a locked device to view sensitive user information. Apple addressed the issue with improved checks in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27. The vulnerability maps to [CWE-287] Improper Authentication and requires physical proximity to the target device. Successful exploitation exposes user data without unlocking the device, though integrity and availability are unaffected.

Critical Impact
An attacker with physical access to a locked iPhone or iPad can bypass authentication checks and view sensitive user information stored on the device.

Affected Products

Apple iOS versions prior to 26.7 and 27
Apple iPadOS versions prior to 26.7 and 27
iPhone and iPad hardware running the affected operating system versions

Discovery Timeline

2026-09-14 - CVE-2026-86890 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in the NVD database

Technical Details for CVE-2026-86890

Vulnerability Analysis

The issue resides in the lock screen authentication logic of iOS and iPadOS. Apple's advisory characterizes the flaw as a logic issue addressed with improved checks. When a device is in the locked state, certain code paths fail to correctly enforce authentication before rendering sensitive user data. This allows an attacker holding the device to trigger a workflow that surfaces protected information without unlocking the screen. The confidentiality impact is high, while integrity and availability of the device remain intact. Apple has not published the specific component or user interface element affected in the advisory text.

Root Cause

The root cause is improper authentication enforcement, categorized under [CWE-287]. A logic path in the locked-device state fails to verify that the current session is authenticated before exposing user data. Apple's fix introduces additional checks to ensure the authentication state is validated before sensitive information is rendered on the lock screen.

Attack Vector

Exploitation requires physical possession of the target device. An unauthenticated attacker interacts with the lock screen or an accessory interface to trigger the vulnerable code path. No user interaction from the legitimate owner is required, and no privileges are needed. The attack complexity is low, but the physical access requirement limits large-scale exploitation to targeted scenarios such as lost, stolen, or unattended devices.

No public proof-of-concept exploit code is available. Apple's advisory does not disclose the precise interaction sequence. Refer to Apple Support Article #149034 and Apple Support Article #149041 for vendor guidance.

Detection Methods for CVE-2026-86890

Indicators of Compromise

Unexplained access to notifications, messages, contacts, or media on a device reported as locked
Mobile device management (MDM) telemetry showing devices running iOS or iPadOS versions below 26.7 or 27
Physical loss or theft reports correlated with reports of exposed personal data

Detection Strategies

Query MDM inventory for iOS and iPadOS build numbers below the patched versions to identify vulnerable fleet devices
Correlate lost or stolen device reports with subsequent unauthorized account activity that could indicate lock-screen data exposure
Audit accessory pairing logs and lock screen widget configurations for anomalies on managed devices

Monitoring Recommendations

Enable MDM compliance policies that flag devices running unpatched iOS or iPadOS builds
Monitor Apple Business Manager and MDM enrollment records for devices that have not checked in after the patch release
Track and report on lost or stolen device workflows, including remote wipe confirmation timestamps

How to Mitigate CVE-2026-86890

Immediate Actions Required

Update all iPhone and iPad devices to iOS 26.7, iPadOS 26.7, iOS 27, or iPadOS 27 immediately
Enforce OS version compliance through MDM and block non-compliant devices from corporate resources
Remotely wipe any lost or stolen device that was running a vulnerable OS version prior to recovery

Patch Information

Apple released the fix in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27. Details are available in Apple Support Article #149034 and Apple Support Article #149041. Users should install updates through Settings > General > Software Update, and administrators should push updates through their MDM platform.

Workarounds

Disable lock screen widgets, notification previews, and Siri access from the lock screen until devices are patched
Require a strong alphanumeric passcode and enable auto-erase after failed passcode attempts
Physically secure devices and reduce the window of unattended access in public or shared environments

bash

# Example MDM compliance check for minimum OS version
# Apply via your MDM platform's compliance policy engine
required_ios_version="26.7"
required_ipados_version="26.7"
action_on_noncompliance="block_corporate_access"
remediation="prompt_user_to_update"