Product:
iOS
Summary
The issue was addressed with improved authentication. An attacker with physical access to a locked device may be able to view sensitive user information. This issue is fixed in iOS 26.4 and other related operating systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2026-28856 |
Exploitation
To exploit this vulnerability, an attacker must have physical access to a locked device. By bypassing the authentication mechanisms, the attacker can potentially access sensitive user information stored on the device.
Affected Products
- iOS: Affected by the vulnerability allowing access to sensitive information with physical access.
- iPadOS: Similar vulnerability as iOS, allowing sensitive information access.
- visionOS: Vulnerable to the same physical access issue.
- watchOS: Also affected by the vulnerability with physical access to the device.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated to the latest versions, specifically iOS 26.4, iPadOS 26.4, visionOS 26.4, and watchOS 26.4. Additionally, users should maintain physical security of their devices to prevent unauthorized access.