iOS CVE-2026-28856

Real-world risk is moderate to low despite the information disclosure classification, constrained by the requirement for physical device access, which significantly limits the attacker pool compared to remote vulnerabilities. The absence of published CVSS, EPSS, or KEV data suggests this was not widely exploited in the wild prior to patching. The threat model is primarily relevant to users in high-risk environments (corporate, law enforcement, high-net-worth individuals) where device theft or unauthorized physical access poses a credible threat; for general users, the risk is lower but non-negligible given the ubiquity of device theft. The prompt patch availability (coordinated across iOS, iPadOS, visionOS, and watchOS 26.4) indicates Apple treated this seriously, and the broad platform consistency suggests a systemic authentication flaw rather than an isolated edge case. Without exploit automation potential or remote attack vectors, this does not warrant emergency response prioritization but should be included in standard quarterly patching cycles.

An attacker with access to an unlocked or physically compromised Apple device could bypass the lock screen authentication checks to access sensitive user information such as notifications, wallet data, health records, or messages visible in the system UI without entering the correct PIN, biometric credentials, or passcode. For example, an attacker could briefly gain possession of a user's iPhone left unattended and leverage this flaw to view financial or health-related Notification Center entries, contact information, or recent messages without triggering the lock screen re-authentication that should normally be required. This scenario is particularly concerning in high-risk environments such as airports, public transport, or workplaces where devices are stolen opportunistically.