iOS CVE-2026-28895

While CVSS scoring and EPSS data are not available for this CVE, the real-world risk is substantial when considering threat modeling factors. The attack vector is physical, which limits the attack surface to scenarios where an attacker has already obtained possession of the device—a significant but realistic threat scenario for high-value targets, corporate espionage, or stolen devices. The attack complexity is low, as the exploit requires only knowledge of the passcode (which may be guessed, shoulder-surfed, or obtained through other means) without requiring specialized technical skills or tools. The technical impact is high: unauthorized access to Protected Apps represents a compromise of confidentiality for sensitive application data, financial accounts, and authentication tokens. The vulnerability is not listed in the CISA KEV catalog at the time of analysis, but the attack automation potential is moderate to high since this likely affects all devices with Stolen Device Protection enabled running vulnerable versions. Organizations should prioritize patching based on the presence of sensitive data in Protected Apps and the likelihood of physical device compromise in their threat model.

An attacker obtains physical access to an iPhone with Stolen Device Protection enabled through theft or temporary possession. The attacker enters the device passcode (obtained through social engineering, observation, or brute force on devices with weak codes) and attempts to open a Protected App such as Apple Pay, banking apps, or sensitive enterprise applications. Due to the vulnerability, the biometric verification requirement is improperly bypassed, allowing the attacker to access the Protected App without providing a fingerprint or face scan, thereby gaining unauthorized access to sensitive financial or personal data contained within the app. This scenario is realistic for stolen devices, lost phones recovered by malicious actors, or targeted physical attacks on high-value targets.