Apple operating systems CVE-2026-28906

No special conditions - remote unauthenticated exploitation against default configurations of iOS, iPadOS, macOS, and visionOS. CVSS vector AV:N/AC:L/PR:N/UI:N confirms network-accessible attack surface with low complexity and no authentication requirements. Exploitation is limited by attacker's network visibility: requires either victim accessing attacker-controlled resources (websites, services) or attacker having network path visibility (ISP-level access, compromised network infrastructure, public Wi-Fi positioning). No user interaction required beyond normal network activity. The vulnerability affects all devices running vulnerable OS versions regardless of configuration, installed applications, or security settings. Exploitation does NOT require physical access, administrative privileges, or non-default feature enablement.

CVSS 7.5 (High) reflects the network attack vector with no authentication required (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact (C:H), though limited to information disclosure with no integrity or availability impact (I:N/A:N). However, real-world risk is substantially lower than the CVSS score suggests. EPSS probability of 0.02% at 7th percentile indicates security researchers and attackers have shown minimal interest in exploiting this class of vulnerability. No CISA KEV listing and no public exploit code identified at time of analysis. The scope is unchanged (S:U), meaning the vulnerability cannot pivot to other components. While the attack complexity is low, the practical impact is limited to privacy violation through IP correlation rather than system compromise, data theft, or service disruption. Security teams should prioritize this below remotely exploitable code execution or authentication bypass vulnerabilities, though privacy-focused organizations and regulated environments may elevate priority. The coordinated multi-platform patch release suggests Apple treated this seriously from a privacy perspective despite limited exploitation evidence.

An attacker operates a malicious website or controls network infrastructure (ISP, public Wi-Fi, compromised router). When a victim using an unpatched Apple device accesses the attacker's web property or traverses monitored network segments, the improper state management causes the device to leak correlation identifiers through IP address handling. The attacker observes IP address patterns across multiple sessions or contexts that should be isolated, enabling tracking of user activity, geolocation inference, or cross-site correlation without requiring cookies or device fingerprinting. No proof-of-concept exploit code is publicly available at time of analysis. The attack requires only network connectivity to victim devices and no authentication, making it scalable for adversaries with network visibility.