What is the CVSS score of CVE-2026-28856?

CVE-2026-28856 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-28856?

Organizations using The should be aware of moderate risk from CVE-2026-28856, a improper access control vulnerability rated CVSS 4.6.. A patch is available.

How to fix or mitigate CVE-2026-28856?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

iOS CVE-2026-28856

EUVD-2026-15127 MEDIUM

Improper Access Control (CWE-284)

2026-03-25 apple

GHSA-9chh-mhfr-3v8v

Apple Authentication Bypass iOS

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15127

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 4.6

DescriptionCVE.org

The issue was addressed with improved authentication. This issue is fixed in iOS 26.4 and iPadOS 26.4, visionOS 26.4, watchOS 26.4. An attacker with physical access to a locked device may be able to view sensitive user information.

AnalysisAI

This vulnerability allows an attacker with physical access to a locked Apple device to view sensitive user information through an authentication bypass. The issue affects iOS and iPadOS versions prior to 26.4, visionOS prior to 26.4, and watchOS prior to 26.4 across all affected device lines. Apple has patched this through improved authentication mechanisms, and while no CVSS score, EPSS data, or known exploits-in-the-wild status are publicly disclosed, the physical access requirement and information disclosure impact characterize this as a moderate-priority security update for users in environments with theft or unauthorized device access risks.

Technical ContextAI

The vulnerability represents an authentication bypass flaw in Apple's device lock screen security implementation, affecting the unified iOS/iPadOS ecosystem (cpe:2.3:a:apple:ios_and_ipados:*:*:*:*:*:*:*:*), visionOS (cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*), and watchOS (cpe:2.3:a:apple:watchos:*:*:*:*:*:*:*:*) platforms. While no specific CWE is documented, the root cause aligns with CWE-287 (Improper Authentication) or CWE-640 (Weak Password Recovery Mechanism), as the flaw permits unauthorized information disclosure without proper credential validation on locked devices. The remediation specifically involved strengthening authentication checks, suggesting the underlying issue was insufficient verification of user identity or device lock state before exposing sensitive data through UI elements, notifications, or system services.

RemediationAI

Users and device administrators should immediately update to iOS 26.4, iPadOS 26.4, visionOS 26.4, and watchOS 26.4 or later through Settings > General > Software Update on each device. Organizations managing multiple Apple devices should deploy these updates via Mobile Device Management (MDM) solutions to ensure comprehensive coverage. Until updates are deployed, users should minimize the risk of physical device compromise by enabling strong device authentication (complex passcode or biometric), avoiding public device access, and using Activation Lock to prevent unauthorized reactivation if theft occurs. For additional mitigation, enable two-factor authentication on Apple ID accounts and review iCloud settings to restrict sensitive data synchronization to devices until patching is complete. Consult Apple's official advisories at https://support.apple.com/en-us/126792, https://support.apple.com/en-us/126798, and https://support.apple.com/en-us/126799 for detailed patch notes and rollout timelines.