What is the CVSS score of CVE-2025-46286?

CVE-2025-46286 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2025-46286?

Organizations using A logic should be aware of moderate risk from CVE-2025-46286 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-46286?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2025-46286

MEDIUM

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-09 product-security@apple.com

Apple iOS Ipados Iphone Os

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 09, 2026 - 22:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being required immediately after Face ID enrollment.

AnalysisAI

A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. [CVSS 4.3 MEDIUM]

Technical ContextAI

Affects Ipados. A logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS 26.2. Restoring from a backup may prevent passcode from being required immediately after Face ID enrollment.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in iOS

View all

CVE-2023-43000 HIGH Act Now POC

8.8 Nov 05

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability

CVE-2026-20700 HIGH Act Now POC

7.8 Feb 11

Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV

CVE-2023-41974 HIGH Act Now POC

7.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability

CVE-2014-7992 MEDIUM This Month POC

5.0 Nov 18

The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti

CVE-2022-48618 HIGH Act Now

7.0 Jan 09

The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)

CVE-2025-66555 HIGH This Week POC

8.8 Dec 04

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type

CVE-2025-46335 HIGH This Week POC

8.6 May 05

Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo

CVE-2021-1385 MEDIUM This Month POC

6.5 Mar 24

A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate

CVE-2026-31852 CRITICAL Act Now

10.0 Mar 11

Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.

CVE-2025-43234 CRITICAL Act Now

9.8 Jul 30

Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO

CVE-2025-43186 CRITICAL Act Now

9.8 Jul 30

Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS

CVE-2023-40414 CRITICAL Act Now

9.8 Jan 10

A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi

Same weakness CWE-288 – Authentication Bypass Using an Alternate Path or Channel

View all

CVE-2024-1709 CRITICAL POC

10.0

CVE-2020-10148 CRITICAL POC

9.8

CVE-2024-55591 CRITICAL POC

9.8

CVE-2025-2747 CRITICAL POC

9.8

CVE-2025-2746 CRITICAL POC

9.8

CVE-2025-4427 MEDIUM POC

5.3

CVE-2025-34026 CRITICAL POC

9.2

CVE-2026-23760 CRITICAL POC

9.8

CVE-2025-46286 vulnerability details – vuln.today

Back

iOS CVE-2025-46286

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in iOS

Same weakness CWE-288 – Authentication Bypass Using an Alternate Path or Channel

Share

External POC / Exploit Code