iOS CVE-2026-28865

Attacker requires privileged network position to intercept network traffic. Affects iOS 18.7.7 and earlier, iPadOS 18.7.7 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Sonoma 14.8.5 and earlier, tvOS 26.4 and earlier, visionOS 26.4 and earlier, watchOS 26.4 and earlier. No victim interaction required; remote network-level access only.

Real-world risk is moderate to elevated despite absent CVSS and EPSS metrics. The vulnerability requires a privileged network position (high attack complexity), which limits the attack surface to specific scenarios such as compromised WiFi networks, BGP hijacking, or compromised network infrastructure. However, the information disclosure impact is significant as network traffic interception can expose sensitive user data, authentication credentials, and personal information. The broad platform coverage across Apple's entire ecosystem (iOS, macOS, tvOS, visionOS, watchOS) indicates a systemic authentication weakness. The availability of multiple vendor security advisories (eight references) and the specific version fix information suggest Apple has addressed a widespread issue. Without KEV status confirmation or public POC availability, the immediate exploitation likelihood appears lower, but organizations in high-security environments (enterprises, healthcare, finance) should prioritize patching due to the privileged network position requirement being achievable through supply chain compromise or insider threats.

An attacker positioned on a corporate WiFi network or through compromised network infrastructure could intercept authentication handshakes and exploit the state management flaw to downgrade security protocols or hijack authenticated sessions. For example, an insider threat or nation-state actor with access to enterprise network infrastructure could leverage this vulnerability to intercept encrypted traffic from thousands of employees' iOS and macOS devices simultaneously, extracting authentication tokens, cookies, or session identifiers that grant access to sensitive cloud services and corporate data. The high barrier to entry (requiring privileged network position) limits opportunistic exploitation but makes the vulnerability particularly concerning in targeted attacks against high-value organizations.